Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 211:

  A company has decided to move its fleet of Linux-based web server instances to an Amazon EC2 Auto Scaling group. Currently, the instances are static and are launched manually. When an administrator needs to view log files, the administrator uses SSH to establish a connection to the instances and retrieves the logs manually.

  The company often needs to query the logs to produce results about application sessions and user issues.

  The company does not want its new automatically scaling architecture to result in the loss of any log files when instances are scaled in.

  Which combination of steps should a security engineer take to meet these requirements MOST cost-effectively? (Select TWO.)

  A. Configure a cron job on the instances to forward the log files to Amazon S3 periodically.
  B. Configure AWS Glue and Amazon Athena to query the log files.
  C. Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs.
  D. Configure Amazon CloudWatch Logs Insights to query the log files.
  E. Configure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume.
  A. Configure a cron job on the instances to forward the log files to Amazon S3 periodically.
  B. Configure AWS Glue and Amazon Athena to query the log files.

  ---

  Explanation

  decided move fleet Linux based makes Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs, plus Configure Amazon CloudWatch Logs Insights to query the log files, the strongest match, because Linux based web server instances asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. Linux based web server instances depends on Configure the Amazon CloudWatch agent on the instances to forward the logs to Amazon CloudWatch Logs, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. server instances EC2 Auto Scaling is reinforced by A company has decided to move its fleet of Linux-based web server instances to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  Auto Scaling group Currently instances also supports Configure Amazon CloudWatch Logs Insights to query the log files,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. Currently instances static launched manually would be weaker with Configure a cron job on the instances to forward the log files to Amazon S3 periodically,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. launched manually administrator view log separates Configure AWS Glue and Amazon Athena to query the log files, and Configure the instances to write the logs to an Amazon Elastic File System (Amazon EFS) volume, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. view log files administrator SSH points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 212:

  A company runs a global ecommerce website that is hosted on AWS. The company uses Amazon CloudFront to serve content to its user base. The company wants to block inbound traffic from a specific set of countries to comply with recent data regulation policies.

  Which solution will meet these requirements MOST cost-effectively?

  A. Create an AWS WAF web ACL with an IP match condition to deny the countries ' IP ranges. Associate the web ACL with the CloudFront distribution.
  B. Create an AWS WAF web ACL with a geo match condition to deny the specific countries. Associate the web ACL with the CloudFront distribution.
  C. Use the geo restriction feature in CloudFront to deny the specific countries.
  D. Use geolocation headers in CloudFront to deny the specific countries.
  A. Create an AWS WAF web ACL with an IP match condition to deny the countries ' IP ranges. Associate the web ACL with the CloudFront distribution.

  ---

  Explanation

  runs global ecommerce website hosted makes Use the geo restriction feature in CloudFront to deny the specific countries, the strongest match, because website hosted CloudFront serve content asks for a managed AWS capability while keeping the service responsibility clear for operations teams. website hosted CloudFront serve content depends on Use the geo restriction feature in CloudFront to deny the specific countries, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. serve content user base wants is reinforced by A company runs a global ecommerce website that is hosted on AWS, The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  base wants block inbound traffic also supports Use the geo restriction feature in CloudFront to deny the specific countries,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. inbound traffic specific set countries would be weaker with Create an AWS WAF web ACL with an IP match condition to deny the countries ' IP ranges, Associate the web ACL with the CloudFront distribution,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. set countries comply recent data separates Create an AWS WAF web ACL with a geo match condition to deny the specific countries, Associate the web ACL with the CloudFront distribution, and Use geolocation headers in CloudFront to deny the specific countries, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. recent data regulation policies requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 213:

  A corporate cloud security policy states that communications between the company ' s VPC and KMS must travel entirely within the AWS network and not use public service endpoints.

  Which combination of the following actions MOST satisfies this requirement? (Select TWO.)

  A. Add theaws:sourceVpcecondition to the AWS KMS key policy referencing the company ' s VPC endpoint ID.
  B. Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.
  C. Create a VPC endpoint for AWS KMS withprivate DNS enabled.
  D. Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.
  E. Add the following condition to the AWS KMS key policy: " aws:SourceIp " : " 10.0.0.0/16 " .
  A. Add theaws:sourceVpcecondition to the AWS KMS key policy referencing the company ' s VPC endpoint ID.
  B. Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.

  ---

  Explanation

  corporate cloud policy states communications makes Add theaws, sourceVpcecondition to the AWS KMS key policy referencing the company ' s VPC endpoint ID, plus Create a VPC endpoint for AWS KMS withprivate DNS enabled, the strongest match, because states communications between VPC KMS asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. states communications between VPC KMS depends on Add theaws, sourceVpcecondition to the AWS KMS key policy referencing the company ' s VPC endpoint ID, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. VPC KMS travel entirely network is reinforced by A corporate cloud security policy states that communications between the company ' s VPC, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  entirely network public endpoints combination also supports Create a VPC endpoint for AWS KMS withprivate DNS enabled,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. endpoints combination actions satisfies requirement would be weaker with Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. satisfies requirement Add theaws sourceVpcecondition separates Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN, and Add the following condition to the AWS KMS key policy, " aws, SourceIp ", " 10, 0, 0, 0/16 ", from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. theaws sourceVpcecondition KMS key policy points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 214:

  A company needs to detect unauthenticated access to its Amazon Elastic Kubernetes Service (Amazon EKS) clusters. The solution must require no additional configuration of the existing EKS deployment.

  Which solution will meet these requirements with the LEAST operational effort?

  A. Install a third-party security add-on.
  B. Enable AWS Security Hub and monitor Kubernetes findings.
  C. Monitor CloudWatch Container Insights metrics for EKS.
  D. Enable Amazon GuardDuty and use EKS Audit Log Monitoring.
  A. Install a third-party security add-on.

  ---

  Explanation

  detect unauthenticated access Elastic Kubernetes makes Enable Amazon GuardDuty and use EKS Audit Log Monitoring, the strongest match, because Elastic Kubernetes EKS clusters require asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. Elastic Kubernetes EKS clusters require depends on Enable Amazon GuardDuty and use EKS Audit Log Monitoring, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. clusters require additional configuration EKS is reinforced by A company needs to detect unauthenticated access to its Amazon Elastic Kubernetes Service (Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  configuration EKS deployment requirements operational also supports Enable Amazon GuardDuty and use EKS Audit Log Monitoring,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. requirements operational effort Enable GuardDuty would be weaker with Install a third-party security add-on,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. Enable GuardDuty EKS Audit Log separates Enable AWS Security Hub and monitor Kubernetes findings, and Monitor CloudWatch Container Insights metrics for EKS, from the requested

  outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. Audit Log Monitoring Install third points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 215:

  A company ' s security engineer is designing an isolation procedure for Amazon EC2 instances as part of an incident response plan. The security engineer needs to isolate a target instance to block any traffic to and from the target instance, except for traffic from the company ' s forensics team. Each of the company ' s EC2 instances has its own dedicated security group. The EC2 instances are deployed in subnets of a VPC. A subnet can contain multiple instances.

  The security engineer is testing the procedure for EC2 isolation and opens an SSH session to the target instance. The procedure starts to simulate access to the target instance by an attacker. The security engineer removes the existing security group rules and adds security group rules to give the forensics team access to the target instance on port 22.

  After these changes, the security engineer notices that the SSH connection is still active and usable.

  When the security engineer runs a ping command to the public IP address of the target instance, the ping command is blocked.

  What should the security engineer do to isolate the target instance?

  A. Add an inbound rule to the security group to allow traffic from 0.0.0.0/0 for all ports. Add an outbound rule to the security group to allow traffic to 0.0.0.0/0 for all ports. Then immediately delete these rules.
  B. Remove the port 22 security group rule. Attach an instance role policy that allows AWS Systems Manager Session Manager connections so that the forensics team can access the target instance.
  C. Create a network ACL that is associated with the target instance ' s subnet. Add a rule at the top of the inbound rule set to deny all traffic from 0.0.0.0/0. Add a rule at the top of the outbound rule set to deny all traffic to 0.0.0.0/0.
  D. Create an AWS Systems Manager document that adds a host-level firewall rule to block all inbound traffic and outbound traffic. Run the document on the target instance.
  A. Add an inbound rule to the security group to allow traffic from 0.0.0.0/0 for all ports. Add an outbound rule to the security group to allow traffic to 0.0.0.0/0 for all ports. Then immediately delete these rules.

  ---

  Explanation

  designing isolation procedure EC2 instances makes Create a network ACL that is associated with the target instance ' s subnet, Add a rule at the top of the inbound rule set to the strongest match, because EC2 instances part incident response asks for a managed AWS capability while keeping the service responsibility clear for operations teams. EC2 instances part incident response depends on Create a network ACL that is associated with the target instance ' s subnet, Add a rule at the top of the inbound rule set to to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. incident response plan isolate target is reinforced by A company ' s security engineer is designing an isolation procedure for Amazon EC2, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  isolate target instance block any also supports Create a network ACL that is associated with the target instance ' s subnet, Add a rule at the top of the inbound rule set to, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. block any traffic target instance would be weaker with Add an inbound rule to the security group to allow traffic from 0, 0, 0, 0/0 for all ports, Add an outbound rule to the security, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. target instance except traffic forensics separates Remove the port 22 security group rule, Attach an instance role policy that allows AWS Systems Manager Session Manager connections so that the forensics team can and Create an AWS Systems Manager document that adds a host-level firewall rule to block all inbound traffic and outbound traffic, Run the document on the target from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. traffic forensics team EC2 instances points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 216:

  A security administrator is setting up a new AWS account. The security administrator wants to secure the data that a company stores in an Amazon S3 bucket. The security administrator also wants to reduce the chance of unintended data exposure and the potential for misconfiguration of objects that are in the S3 bucket.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Configure the S3 Block Public Access feature for the AWS account.
  B. Configure the S3 Block Public Access feature for all objects that are in the bucket.
  C. Deactivate ACLs for objects that are in the bucket.
  D. Use AWS PrivateLink for Amazon S3 to access the bucket.
  A. Configure the S3 Block Public Access feature for the AWS account.

  ---

  Explanation

  administrator setting new wants secure makes Configure the S3 Block Public Access feature for the AWS account, the strongest match, because administrator wants secure data stores asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. administrator wants secure data stores depends on Configure the S3 Block Public Access feature for the AWS account, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. data stores bucket administrator also is reinforced by A security administrator is setting up a new AWS account, The security administrator wants, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  administrator also wants reduce chance also supports Configure the S3 Block Public Access feature for the AWS account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. reduce chance unintended data exposure would be weaker with Configure the S3 Block Public Access feature for all objects that are in the bucket,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. data exposure potential misconfiguration objects separates Deactivate ACLs for objects that are in the bucket, and Use AWS PrivateLink for Amazon S3 to access the bucket, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. misconfiguration objects bucket requirements operational points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 217:

  A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company uses AWS IAM Identity Center to manage access to the accounts. The company uses AWS Directory Service as an identity source. Employees access the AWS console and specific AWS accounts and permissions through the AWS access portal.

  A security engineer creates a new permissions set in IAM Identity Center and assigns the permissions set to one of the member accounts in the organization. The security engineer assigns the permissions set to a user

  group for developers namedDevOpsin the member account. The security engineer expects all the developers to see the new permissions set listed for the member account in the AWS access portal. All the developers except for one can see the permissions set. The security engineer must ensure that the

  remaining developer can see the permissions set in the AWS access portal.

  Which solution will meet this requirement?

  A. Add the remaining developer to the DevOps group in Directory Service.
  B. Remove and then re-add the permissions set in the member account.
  C. Add the service-linked role for organization to the member account.
  D. Update the permissions set to allow console access for the remaining developer.
  A. Add the remaining developer to the DevOps group in Directory Service.

  ---

  Explanation

  organization Organizations manage multiple IAM makes Add the remaining developer to the DevOps group in Directory Service, the strongest match, because multiple IAM Identity Center manage asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. multiple IAM Identity Center manage depends on Add the remaining developer to the DevOps group in Directory Service, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. Center manage access Directory identity is reinforced by A company uses an organization in AWS Organizations to manage multiple AWS accounts, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  Directory identity source Employees access also supports Add the remaining developer to the DevOps group in Directory Service,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. Employees access console specific permissions would be weaker with Remove and then re-add the permissions set in the member account,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. specific permissions through access portal separates Add the service-linked role for organization to the member account, and Update the permissions set to allow console access for the remaining developer, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. access portal creates new permissions points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 218:

  A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company ' s primary website. The GuardDuty finding received read: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor.

  What is the first step the security engineer should take?

  A. Open the EC2 console and remove any security groups that allow inbound traffic from 0.0.0.0/0.
  B. Install the AWS Systems Manager Agent on the EC2 instance and run an inventory report.
  C. Install the Amazon Inspector agent on the host and run an assessment with the CVE rules package.
  D. Open the IAM console and revoke all IAM sessions that are associated with the instance profile.
  A. Open the EC2 console and remove any security groups that allow inbound traffic from 0.0.0.0/0.

  ---

  Explanation

  received GuardDuty alert indicating finding makes Open the IAM console and revoke all IAM sessions that are associated with the instance profile, the strongest match, because indicating finding involving EC2 instance asks for a managed AWS capability and the design remains easier to govern across the environment. indicating finding involving EC2 instance depends on Open the IAM console and revoke all IAM sessions that are associated with the instance profile, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. EC2 instance hosts primary website is reinforced by A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  primary website GuardDuty finding received also supports Open the IAM console and revoke all IAM sessions that are associated with the instance profile,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. finding received read UnauthorizedAccess IAMUser would be weaker with Open the EC2 console and remove any security groups that allow inbound traffic from 0, 0, 0, 0/0,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. UnauthorizedAccess IAMUser InstanceCredentialExfiltration confirmed malicious separates Install the AWS Systems Manager Agent on the EC2 instance and run an inventory report, and Install the Amazon Inspector agent on the host and run an assessment with the CVE rules package, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. confirmed malicious actor used API points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 219:

  A company uses AWS Lambda functions to implement application logic. The company uses an organization in AWS Organizations to manage hundreds of AWS accounts. The company needs to implement a solution to continuously monitor the Lambda functions for vulnerabilities in all accounts. The solution must publish detected issues to a dashboard. Lambda functions that are being tested or are in development must not appear on the dashboard.

  Which combination of steps will meet these requirements? (Select TWO.)

  A. Designate a delegated Amazon GuardDuty administrator account in the organization's management account. Use the GuardDuty Summary dashboard to obtain an overview of Lambda functions that have vulnerabilities.
  B. Designate a delegated Amazon Inspector administrator account in the organization's management account. Use the Amazon Inspector dashboard to obtain an overview of Lambda functions that have vulnerabilities.
  C. Apply tags of "test" or "development" to all Lambda functions that are in testing or development. Use a suppression filter that suppresses findings that contain these tags.
  D. Enable AWS Shield Advanced in the organization's management account. Use Amazon CloudWatch to build a dashboard for Lambda functions that have vulnerabilities.
  E. Enable Lambda Protection in GuardDuty for all accounts. Auto-enable Lambda Protection for new accounts. Apply a tag to the Lambda functions that are in testing or development. Use GuardDutyExclusion as the tag key and LambdaStandardScanning as the tag value.
  A. Designate a delegated Amazon GuardDuty administrator account in the organization's management account. Use the GuardDuty Summary dashboard to obtain an overview of Lambda functions that have vulnerabilities.
  B. Designate a delegated Amazon Inspector administrator account in the organization's management account. Use the Amazon Inspector dashboard to obtain an overview of Lambda functions that have vulnerabilities.

  ---

  Explanation

  Lambda functions implement application logic makes Designate a delegated Amazon Inspector administrator account in the organization's management account, Use the Amazon Inspector dashboard to obtain an overview of Lambda functions that have plus Apply tags of "test" or "development" to all Lambda functions that are in testing or development, Use a suppression filter that suppresses findings that contain these the strongest match, because application logic organization Organizations manage asks for a managed AWS capability and that reduces the need for extra supervisory automation. application logic organization Organizations manage depends on Designate a delegated Amazon Inspector administrator account in the organization's management account, Use the Amazon Inspector dashboard to obtain an overview of Lambda functions that have to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. Organizations manage hundreds implement continuously is reinforced by A company uses AWS Lambda functions to implement application logic, The company uses an, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  implement continuously monitor Lambda functions also supports Apply tags of "test" or "development" to all Lambda functions that are in testing or development, Use a suppression filter that suppresses findings that contain these, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. Lambda functions vulnerabilities publish detected would be weaker with Designate a delegated Amazon GuardDuty administrator account in the organization's management account, Use the GuardDuty Summary dashboard to obtain an overview of Lambda functions that have, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. publish detected issues dashboard Lambda separates Enable AWS Shield Advanced in the organization's management account, Use Amazon CloudWatch to build a dashboard for Lambda functions that have vulnerabilities, and Enable Lambda Protection in GuardDuty for all accounts, Auto-enable Lambda Protection for new accounts, Apply a tag to the Lambda functions that are in testing or from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. dashboard Lambda functions being tested points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 220:

  A company needs to implement data lifecycle management for Amazon RDS snapshots. The company will use AWS Backup to manage the snapshots. The company must retain RDS automated snapshots for 5 years and will use Amazon S3 for long-term archival storage.

  Which solution will meet these requirements?

  A. Use AWS Backup to apply a 5-year retention tag to the RDS snapshots.
  B. Enable versioning on the S3 bucket that AWS Backup uses for the RDS snapshots. Configure a 5-year retention period.
  C. Create an S3 Lifecycle policy. Include a 5-year retention period for the S3 bucket that AWS Backup uses for the RDS snapshots.
  D. Create a backup plan in AWS Backup. Configure a 5-year retention period.
  A. Use AWS Backup to apply a 5-year retention tag to the RDS snapshots.

  ---

  Explanation

  implement data lifecycle management RDS makes Create a backup plan in AWS Backup, Configure a 5- year retention period, the strongest match, because management RDS snapshots Backup manage asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. management RDS snapshots Backup manage depends on Create a backup plan in AWS Backup, Configure a 5-year retention period, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. Backup manage snapshots retain RDS is reinforced by A company needs to implement data lifecycle management for Amazon RDS snapshots, The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  retain RDS automated snapshots years also supports Create a backup plan in AWS Backup, Configure a 5- year retention period,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. snapshots years long term archival would be weaker with Use AWS Backup to apply a 5-year retention tag to the RDS snapshots,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. term archival storage requirements backup separates Enable versioning on the S3 bucket that AWS Backup uses for the RDS snapshots, Configure a 5-year retention period, and Create an S3 Lifecycle policy, Include a 5-year retention period for the S3 bucket that AWS Backup uses for the RDS snapshots, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. requirements backup plan year retention points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.