Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 201:

  A company has contracted with a third party to audit several AWS accounts. To enable the audit, cross-account IAM roles have been created in each account targeted for audit. The auditor is having trouble accessing some of the accounts.

  Which of the following may be causing this problem? (Select THREE.)

  A. The external ID used by the auditor is missing or incorrect.
  B. The auditor is using the incorrect password.
  C. The auditor has not been grantedsts:AssumeRolefor the role in the destination account.
  D. The Amazon EC2 role used by the auditor must be set to the destination account role.
  E. The secret key used by the auditor is missing or incorrect.
  F. The role ARN used by the auditor is missing or incorrect.
  A. The external ID used by the auditor is missing or incorrect.
  B. The auditor is using the incorrect password.

  ---

  Explanation

  contracted third party audit several makes.

  The external ID used by the auditor is missing or incorrect, plus

  The auditor has not been grantedsts, AssumeRolefor the role in the destination account, plus.

  The role ARN used by the auditor is missing or incorrect, the strongest match, because audit several enable cross IAM asks for a managed AWS capability and the design remains easier to govern across the environment. audit several enable cross IAM depends on The external ID used by the auditor is missing or incorrect, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. audit cross IAM roles been is reinforced by A company has contracted with a third party to audit several AWS accounts, To, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  roles been created targeted audit also supports The auditor has not been grantedsts, AssumeRolefor the role in the destination account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. targeted audit auditor having trouble would be weaker with The auditor is using the incorrect password,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. having trouble accessing some may separates The Amazon EC2 role used by the auditor must be set to the destination account role, and The secret key used by the auditor is missing or incorrect, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. some may causing problem external points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 202:

  A company has multiple accounts in the AWS Cloud. Users in the developer account need to have access to specific resources in the production account.

  What is the MOST secure way to provide this access?

  A. Create one IAM user in the production account. Grant the appropriate permissions to the resources that are needed. Share the password only with the users that need access.
  B. Create cross-account access with an IAM role in the developer account. Grant the appropriate permissions to this role. Allow users in the developer account to assume this role to access the production resources.
  C. Create cross-account access with an IAM user account in the production account. Grant the appropriate permissions to this user account. Allow users in the developer account to use this user account to access the production resources.
  D. Create cross-account access with an IAM role in the production account. Grant the appropriate permissions to this role. Allow users in the developer account to assume this role to access the production resources.
  A. Create one IAM user in the production account. Grant the appropriate permissions to the resources that are needed. Share the password only with the users that need access.

  ---

  Explanation

  multiple Cloud Users developer need makes Create cross-account access with an IAM role in the production account, Grant the appropriate permissions to this role, Allow users in the developer account to assume the strongest match, because developer need access specific resources asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. developer need access specific resources depends on Create cross-account access with an IAM role in the production account, Grant the appropriate permissions to this role, Allow users in the developer account to assume to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. specific resources production.

  What secure is reinforced by A company has multiple accounts in the AWS Cloud, Users in the developer account, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  What secure way provide access also supports Create cross-account access with an IAM role in the production account, Grant the appropriate permissions to this role, Allow users in the developer account to assume, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. provide access cross IAM role would be weaker with Create one IAM user in the production account, Grant the appropriate permissions to the resources that are needed, Share the password only with the users that, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. access IAM role production Grant separates Create cross-account access with an IAM role in the developer account, Grant the appropriate permissions to this role, Allow users in the developer account to assume and Create cross-account access with an IAM user account in the production account, Grant the appropriate permissions to this user account, Allow users in the developer account from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. production Grant appropriate permissions role points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 203:

  A company's web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. Instance logs are lost after reboots. The operations team suspects malicious activity targeting a specific PHP file.

  Which set of actions will identify the suspect attacker's IP address for future occurrences?

  A. Configure VPC Flow Logs and search for PHP file activity.
  B. Install the CloudWatch agent on the ALB and export application logs.
  C. Export ALB access logs to Amazon OpenSearch Service and search them.
  D. Configure the web ACL to send logs to Amazon Kinesis Data Firehose. Deliver logs to Amazon S3 and query them with Amazon Athena.
  A. Configure VPC Flow Logs and search for PHP file activity.

  ---

  Explanation

  web application runs EC2 instances makes Configure the web ACL to send logs to Amazon Kinesis Data Firehose, Deliver logs to Amazon S3 and query them with Amazon Athena, the strongest match, because EC2 instances behind Application Load asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. EC2 instances behind Application Load depends on Configure the web ACL to send logs to Amazon Kinesis Data Firehose, Deliver logs to Amazon S3 and query them with Amazon Athena, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. Application Load Balancer ALB Auto is reinforced by A company's web application runs on Amazon EC2 instances behind an Application Load Balancer, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  ALB Auto Scaling group WAF also supports Configure the web ACL to send logs to Amazon Kinesis Data Firehose, Deliver logs to Amazon S3 and query them with Amazon Athena,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. group WAF web ACL associated would be weaker with Configure VPC Flow Logs and search for PHP file activity,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. ACL associated ALB Instance logs separates Install the CloudWatch agent on the ALB and export application logs, and Export ALB access logs to Amazon OpenSearch Service and search them, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. Instance logs lost reboots operations points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 204:

  A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store ' s application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account.

  The company uses AWS Organizations and has an OU that is used only for these accounts.

  The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company ' s deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access.

  The security engineer already has created an AWS CloudFormation template that implements the deployment plan.

  What should the security engineer do next to meet the requirements in theMOST secureway?

  A. Create an AWS Service Catalog portfolio in the organization ' s management account. Upload the CloudFormation template. Add the template to the portfolio ' s product list. Share the portfolio with the OU.
  B. Use the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. Create an SCP that allows access to the extension.
  C. Create an AWS Service Catalog portfolio and create an IAM role for cross-account access. Attach the AWSServiceCatalogEndUserFullAccess managed policy to the role.
  D. Use the CloudFormation CLI to create a module and share the extension directly with the OU.
  A. Create an AWS Service Catalog portfolio in the organization ' s management account. Upload the CloudFormation template. Add the template to the portfolio ' s product list. Share the portfolio with the OU.

  ---

  Explanation

  expanding group stores day new makes Create an AWS Service Catalog portfolio in the organization ' s management account, Upload the CloudFormation template, Add the template to the portfolio ' s product the strongest match, because day new store opens wants asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. day new store opens wants depends on Create an AWS Service Catalog portfolio in the organization ' s management account, Upload the CloudFormation template, Add the template to the portfolio ' s product to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. opens wants launch customized web is reinforced by A company is expanding its group of stores, On the day that each new, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  customized web application store non also supports Create an AWS Service Catalog portfolio in the organization ' s management account, Upload the CloudFormation template, Add the template to the portfolio ' s product, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. store application non production environment would be weaker with Use the CloudFormation CLI to create a module from the CloudFormation template, Register the module as a private extension in the CloudFormation registry, Publish the extension,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. non production environment deployed separate separates Create an AWS Service Catalog portfolio and create an IAM role for cross-account access, Attach the AWSServiceCatalogEndUserFullAccess managed policy to the role, and Use the CloudFormation CLI to create a module and share the extension directly with the OU, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. production environment deployed separate Organizations points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 205:

  A company is investigating an increase in its AWS monthly bill. The company discovers that bad actors compromised some Amazon EC2 instances and served webpages for a large email phishing campaign. A security engineer must implement a solution to monitor for cost increases in the future to help detect malicious activity.

  Which solution will offer the company the EARLIEST detection of cost increases?

  A. Create an Amazon EventBridge rule that invokes an AWS Lambda function hourly. Program the Lambda function to download an AWS usage report from AWS Data Exports about usage of all services. Program the Lambda function to analyze the report and to send a notification when anomalies are detected.
  B. Create a cost monitor in AWS Cost Anomaly Detection. Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage above the expected cost exceeds a threshold.
  C. Review AWS Cost Explorer daily to detect anomalies in cost from prior months. Review the usage of any services that experience a significant cost increase from prior months.
  D. Capture VPC flow logs from the VPC where the EC2 instances run. Use a third-party network analysis tool to analyze the flow logs and to detect anomalies in network traffic that might increase cost.
  A. Create an Amazon EventBridge rule that invokes an AWS Lambda function hourly. Program the Lambda function to download an AWS usage report from AWS Data Exports about usage of all services. Program the Lambda function to analyze the report and to send a notification when anomalies are detected.

  ---

  Explanation

  investigating increase monthly bill discovers makes Create a cost monitor in AWS Cost Anomaly Detection, Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage the strongest match, because bill discovers bad actors compromised asks for a managed AWS capability while keeping the service responsibility clear for operations teams. bill discovers bad actors compromised depends on Create a cost monitor in AWS Cost Anomaly Detection, Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. actors compromised some EC2 instances is reinforced by A company is investigating an increase in its AWS monthly bill, The company discovers, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  EC2 instances served webpages large also supports Create a cost monitor in AWS Cost Anomaly Detection, Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. webpages large email phishing campaign would be weaker with Create an Amazon EventBridge rule that invokes an AWS Lambda function hourly, Program the Lambda function to download an AWS usage report from AWS Data Exports, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. phishing campaign implement monitor cost separates Review AWS Cost Explorer daily to detect anomalies in cost from prior months, Review the usage of any services that experience a significant cost increase from and Capture VPC flow logs from the VPC where the EC2 instances run, Use a third-party network analysis tool to analyze the flow logs and to detect from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. monitor cost increases help detect points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 206:

  A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application. The application processes sensitive data and has the following compliance requirements:

  - No remote access management ports to the EC2 instances can be exposed internally or externally.

  - All remote session activity must be recorded in an audit log.

  - All remote access to the EC2 instances must be authenticated and authorized by AWS IAM Identity Center. The company ' s DevOps team occasionally needs to connect to one of the EC2 instances to troubleshoot issues.

  Which solution will provide remote access to the EC2 instances while meeting the compliance requirements?

  A. Grant access to the EC2 serial console at the account level.
  B. Enable EC2 Instance Connect and configure security group rules.
  C. Assign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy that grants access to Systems Manager Session Manager. Assign the policy to an IAM role of the DevOps team.
  D. Use AWS Systems Manager Automation runbooks to open remote access ports.
  A. Grant access to the EC2 serial console at the account level.

  ---

  Explanation

  large fleet Linux EC2 instances makes Assign an EC2 instance role that allows access to AWS Systems Manager, Create an IAM policy that grants access to Systems Manager Session Manager, Assign the the strongest match, because EC2 instances run application processes asks for a managed AWS capability while keeping the service responsibility clear for operations teams. EC2 instances run application processes depends on Assign an EC2 instance role that allows access to AWS Systems Manager, Create an IAM policy that grants access to Systems Manager Session Manager, Assign the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. application processes sensitive data compliance is reinforced by A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  sensitive data compliance requirements remote also supports Assign an EC2 instance role that allows access to AWS Systems Manager, Create an IAM policy that grants access to Systems Manager Session Manager, Assign the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. requirements remote access management ports would be weaker with Grant access to the EC2 serial console at the account level,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. management ports EC2 instances exposed separates Enable EC2 Instance Connect and configure security group rules, and Use AWS Systems Manager Automation runbooks to open remote access ports, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. instances exposed internally externally remote points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 207:

  A company is using AWS CloudTrail and Amazon CloudWatch to monitor resources in an AWS account.

  The company's developers have been using an IAM role in the account for the last 3 months.

  A security engineer needs to refine the customer managed IAM policy attached to the role to ensure that the role provides least privilege access.

  Which solution will meet this requirement with the LEAST effort?

  A. Implement AWS IAM Access Analyzer policy generation on the role.
  B. Implement AWS IAM Access Analyzer policy validation on the role.
  C. Search CloudWatch logs to determine the actions the role invoked and to evaluate the permissions.
  D. Use AWS Trusted Advisor to compare the policies assigned to the role against AWS best practices.
  A. Implement AWS IAM Access Analyzer policy generation on the role.

  ---

  Explanation

  CloudTrail CloudWatch monitor resources developers makes Implement AWS IAM Access Analyzer policy generation on the role, the strongest match, because resources developers been IAM role asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. resources developers been IAM role depends on Implement AWS IAM Access Analyzer policy generation on the role, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. IAM role last months refine is reinforced by A company is using AWS CloudTrail and Amazon CloudWatch to monitor resources in an, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  months refine customer managed IAM also supports Implement AWS IAM Access Analyzer policy generation on the role,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. managed IAM policy attached role would be weaker with Implement AWS IAM Access Analyzer policy validation on the role,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. attached role ensure provides privilege separates Search CloudWatch logs to determine the actions the role invoked and to evaluate the permissions, and Use AWS Trusted Advisor to compare the policies assigned to the role against AWS best practices, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. role provides privilege access requirement points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 208:

  A company is running a new workload across accounts that are in an organization in AWS Organizations.

  All running resources must have a tag ofCostCenter, and the tag must have one of three approved values.

  The company must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value.

  Which solution will meet these requirements?

  A. Create an AWS Config Custom Policy rule by using AWS CloudFormation Guard. Include the tag key of CostCenter and the approved values. Create an SCP that denies the creation of resources when the valueof the aws:RequestTag/CostCenter condition key is not one of the three approved values.
  B. Create an AWS CloudTrail trail. Create an Amazon EventBridge rule that includes a rule statement that matches the creation of new resources. Configure the EventBridge rule to invoke an AWS Lambda function that checks for the CostCenter tag. Program the Lambda function to block creation in case of a noncompliant value.
  C. Enable tag policies for the organization. Create a tag policy that specifies a tag key of CostCenter and the approved values. Configure the policy to enforce noncompliant operations. Create an SCP that denies the creation of resources when the aws:RequestTag/CostCenter condition key has a null value.
  D. Enable tag policies for the organization. Create a tag policy that specifies a tag key of CostCenter and the approved values. Create an Amazon EventBridge rule that invokes an AWS Lambda function when a noncompliant tag is created. Program the Lambda function to block changes to the tag.
  A. Create an AWS Config Custom Policy rule by using AWS CloudFormation Guard. Include the tag key of CostCenter and the approved values. Create an SCP that denies the creation of resources when the valueof the aws:RequestTag/CostCenter condition key is not one of the three approved values.

  ---

  Explanation

  running new workload organization Organizations makes Create an AWS Config Custom Policy rule by using AWS CloudFormation Guard, Include the tag key of CostCenter and the approved values, Create an SCP that the strongest match, because organization Organizations running resources tag asks for a managed AWS capability while keeping the service responsibility clear for operations teams. organization Organizations running resources tag depends on Create an AWS Config Custom Policy rule by using AWS

  CloudFormation Guard, Include the tag key of CostCenter and the approved values, Create an SCP that to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. resources tag ofCostCenter approved values is reinforced by A company is running a new workload across accounts that are in an organization, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  tag approved values enforce policy also supports Create an AWS Config Custom Policy rule by using AWS CloudFormation Guard, Include the tag key of CostCenter and the approved values, Create an SCP that, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. enforce policy prevent any changes would be weaker with Create an AWS CloudTrail trail, Create an Amazon EventBridge rule that includes a rule statement that matches the creation of new resources, Configure the EventBridge rule, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. any changes CostCenter tag non separates Enable tag policies for the organization, Create a tag policy that specifies a tag key of CostCenter and the approved values, Configure the policy to enforce

  and Enable tag policies for the organization, Create a tag policy that specifies a tag key of CostCenter and the approved values, Create an Amazon EventBridge rule from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. tag non approved value requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 209:

  A company begins to use AWS WAF after experiencing an increase in traffic to the company ' s public web applications. A security engineer needs to determine if the increase in traffic is because of application-layer attacks. The security engineer needs a solution to analyze AWS WAF traffic.

  Which solution will meet this requirement?

  A. Configure AWS WAF to send logs to a trail in AWS CloudTrail. Create an Amazon Data Firehose delivery stream to send the logs to Amazon OpenSearch Service. Use OpenSearch Dashboards and an Amazon Athena connector to query the logs.
  B. Configure AWS WAF to send logs to an Amazon S3 bucket. Configure an OpenSearch table with a partition projection of the S3 bucket. Use OpenSearch to query the data in the S3 bucket.
  C. Configure AWS WAF to send logs to an Amazon S3 bucket. Configure an Amazon Athena table with a partition projection of the S3 bucket. Use Athena to query the data in the S3 bucket.
  D. Configure AWS WAF to send logs to a trail in AWS CloudTrail. Create an Amazon Data Firehose delivery stream to send the logs to an Amazon S3 bucket. Use Amazon Athena to query the data in the S3 bucket.
  A. Configure AWS WAF to send logs to a trail in AWS CloudTrail. Create an Amazon Data Firehose delivery stream to send the logs to Amazon OpenSearch Service. Use OpenSearch Dashboards and an Amazon Athena connector to query the logs.

  ---

  Explanation

  begins WAF experiencing increase traffic makes Configure AWS WAF to send logs to an Amazon S3 bucket, Configure an Amazon Athena table with a partition projection of the S3 bucket, Use Athena the strongest match, because increase traffic public web applications asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. increase traffic public web applications depends on Configure AWS WAF to send logs to an Amazon S3 bucket, Configure an Amazon Athena table with a partition projection of the S3 bucket, Use Athena to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. web applications determine increase traffic is reinforced by A company begins to use AWS WAF after experiencing an increase in traffic to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  increase traffic because application layer also supports Configure AWS WAF to send logs to an Amazon S3 bucket, Configure an Amazon Athena table with a partition projection of the S3 bucket, Use Athena, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. application layer attacks analyze WAF would be weaker with Configure AWS WAF to send logs to a trail in AWS CloudTrail, Create an Amazon Data Firehose delivery stream to send the logs to Amazon OpenSearch, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. analyze WAF traffic requirement send separates Configure AWS WAF to send logs to an Amazon S3 bucket, Configure an OpenSearch table with a partition projection of the S3 bucket, Use OpenSearch to and Configure AWS WAF to send logs to a trail in AWS CloudTrail, Create an Amazon Data Firehose delivery stream to send the logs to an Amazon from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. requirement WAF send logs bucket points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 210:

  A security engineer wants to create a new AWS KMS customer managed key. The KMSAdmin IAM role will create and disable this key. The KMSUser IAM role will use this key for decryption.

  Which key policy will meet these requirements?

  A. A key policy that grants KMSAdmin only kms:Create and kms:Disable*, and grants KMSUser kms: Decrypt.
  B. A key policy that grants KMSAdmin kms:Create* and kms:Disable*, and grants KMSUser kms: Decrypt.
  C. A key policy that grants KMSAdmin and KMSUser kms:CreateGrant, but does not grant KMSUser kms:Decrypt.
  D. A key policy that grants both KMSAdmin and KMSUser only kms:Decrypt*.
  A. A key policy that grants KMSAdmin only kms:Create and kms:Disable*, and grants KMSUser kms: Decrypt.

  ---

  Explanation

  wants new KMS customer managed makes A key policy that grants KMSAdmin kms, Create* and kms, Disable*, and grants KMSUser kms, Decrypt, the strongest match, because customer managed key KMSAdmin IAM asks for a managed AWS capability while keeping the service responsibility clear for operations teams. customer managed key KMSAdmin IAM depends on A key policy that grants KMSAdmin kms, Create* and kms, Disable*, and grants KMSUser kms, Decrypt, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. KMSAdmin IAM role disable key is reinforced by A security engineer wants to create a new AWS KMS customer managed key, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  disable key KMSUser IAM role also supports A key policy that grants KMSAdmin kms, Create* and kms, Disable*, and grants KMSUser kms, Decrypt,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. IAM role key decryption policy would be weaker with A key policy that grants KMSAdmin only kms, Create and kms, Disable*, and grants KMSUser kms, Decrypt,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. decryption key policy requirements grants separates A key policy that grants KMSAdmin and KMSUser kms, CreateGrant, but

  does not grant KMSUser kms, Decrypt, and A key policy that grants both KMSAdmin and KMSUser only kms, Decrypt*, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. requirements key policy grants KMSAdmin points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.