Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 221:

  A company ' s security engineer receives an abuse notification from AWS indicating that malware is being hosted from the company's AWS account. The security engineer discovers that an IAM user created a new Amazon S3 bucket without authorization.

  Which combination of steps should the security engineer take to MINIMIZE the consequences of this compromise? (Select THREE.)

  A. Encrypt all AWS CloudTrail logs.
  B. Turn on Amazon GuardDuty.
  C. Change the password for all IAM users.
  D. Rotate or delete all AWS access keys.
  E. Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
  F. Delete any resources that are unrecognized or unauthorized.
  A. Encrypt all AWS CloudTrail logs.
  B. Turn on Amazon GuardDuty.

  ---

  Explanation

  receives abuse notification indicating malware makes Turn on Amazon GuardDuty, plus Rotate or delete all AWS access keys, plus Delete any resources that are unrecognized or unauthorized, the strongest match, because indicating malware being hosted discovers asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. indicating malware being hosted discovers depends on Turn on Amazon GuardDuty, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. hosted discovers IAM user created is reinforced by A company ' s security engineer receives an abuse notification from AWS indicating that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable. user created new bucket without also supports Rotate or delete all AWS access keys,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. bucket without authorization combination steps would be weaker with Encrypt all AWS CloudTrail logs,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. combination steps should take MINIMIZE separates Change the password for all IAM users, and Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. take MINIMIZE consequences compromise Turn points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 222:

  A company is running a new workload across accounts in an organization in AWS Organizations. All running resources must have a tag of CostCenter, and the tag must have one of three approved values.

  The company must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value.

  Which solution will meet these requirements?

  A. Use AWS Config custom policy rule and an SCP to deny non-approved aws:RequestTag/CostCenter values.
  B. Use CloudTrail + EventBridge + Lambda to block creation.
  C. Enable tag policies, define allowed values, enforce noncompliant operations, and use an SCP to deny creation when aws:RequestTag/CostCenter is null.
  D. Enable tag policies and use EventBridge + Lambda to block changes.
  A. Use AWS Config custom policy rule and an SCP to deny non-approved aws:RequestTag/CostCenter values.

  ---

  Explanation

  running new workload organization Organizations makes Enable tag policies, define allowed values, enforce noncompliant operations, and use an SCP to deny creation when aws, RequestTag/CostCenter is null, the strongest match, because organization Organizations running resources tag asks for a managed AWS capability which is important when security controls must be repeatable. organization Organizations running resources tag depends on Enable tag policies, define allowed values, enforce noncompliant operations, and use an SCP to deny creation when aws, RequestTag/CostCenter is null, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. resources tag CostCenter approved values is reinforced by A company is running a new workload across accounts in an organization in AWS, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  tag approved values enforce policy also supports Enable tag policies, define allowed values, enforce noncompliant operations, and use an SCP to deny creation when aws, RequestTag/CostCenter is null,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. enforce policy prevent any changes would be weaker with Use AWS Config custom policy rule and an SCP to deny

  non-approved aws, RequestTag/CostCenter values,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. any changes CostCenter tag non separates Use CloudTrail + EventBridge + Lambda to block creation, and Enable tag policies and use EventBridge + Lambda to block changes, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. tag non approved value requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 223:

  A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that run an application processing sensitive data. Compliance requirements include no exposed management ports, full session logging, and authentication through AWS IAM Identity Center. DevOps engineers occasionally need access for troubleshooting.

  Which solution will provide remote access while meeting these requirements?

  A. Grant access to the EC2 serial console and allow IAM role access.
  B. Enable EC2 Instance Connect and configure security groups accordingly.
  C. Assign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy that grants access to Systems Manager Session Manager and assign it to an IAM Identity Center role.
  D. Use Systems Manager Automation to temporarily open remote access ports.
  A. Grant access to the EC2 serial console and allow IAM role access.

  ---

  Explanation

  large fleet Linux EC2 instances makes Assign an EC2 instance role that allows access to AWS Systems Manager, Create an IAM policy that grants access to Systems Manager Session Manager and assign the strongest match, because EC2 instances run application processing asks for a managed AWS capability and the design remains easier to govern across the environment. EC2 instances run application processing depends on Assign an EC2 instance role that allows access to AWS Systems Manager, Create an IAM policy that grants access to Systems Manager Session Manager and assign to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. application processing sensitive data Compliance is reinforced by A company has a large fleet of Amazon Linux 2 Amazon EC2 instances that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  data Compliance requirements include exposed also supports Assign an EC2 instance role that allows access to AWS Systems Manager, Create an IAM policy that grants access to Systems Manager Session Manager and assign, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. include exposed management ports full would be weaker with Grant access to the EC2 serial console and allow IAM role access,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. ports full session logging authentication separates Enable EC2 Instance Connect and configure security groups accordingly, and Use Systems Manager Automation to temporarily open remote access ports, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. logging authentication through IAM Identity points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 224:

  A security engineer for a company wants to maintain all IAM users and roles according to the principle of least privilege. The security engineer plans to audit the IAM permissions once every 365 days. The security engineer must view the permissions that each IAM identity used in the last 365 days and must remove any unused permissions.

  Which solution will meet these requirements?

  A. Use AWS CloudTrail logs to review IAM identity actions and to remove unused permissions.
  B. Use AWS Config to review configuration changes by each IAM identity and to remove unused permissions.
  C. Use AWS Identity and Access Management Access Analyzer to review last accessed information and to remove unused permissions.
  D. Use AWS Trusted Advisor to check the IAM identities that have elevated permissions and to remove unused permissions.
  A. Use AWS CloudTrail logs to review IAM identity actions and to remove unused permissions.

  ---

  Explanation

  wants maintain IAM users roles makes Use AWS Identity and Access Management Access Analyzer to review last accessed information and to remove unused permissions, the strongest match, because users roles according principle privilege asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. users roles according principle privilege depends on Use AWS Identity and Access Management Access Analyzer to review last accessed information and to remove unused permissions, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. principle privilege plans audit IAM is reinforced by A security engineer for a company wants to maintain all IAM users and roles, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  audit IAM permissions once every also supports Use AWS Identity and Access Management Access Analyzer to review last accessed information and to remove unused permissions,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. once every 365 days view would be weaker with Use AWS CloudTrail logs to review IAM identity actions and to remove unused permissions,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. days view permissions IAM identity separates Use AWS Config to review configuration changes by each IAM identity and to remove unused permissions, and Use AWS Trusted Advisor to check the IAM identities that have elevated permissions and to remove unused permissions, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. IAM identity used last 365 points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 225:

  A company runs a web application on a fleet of Amazon EC2 instances in an Auto Scaling group. Amazon GuardDuty and AWS Security Hub are enabled. The security engineer needs an automated response to anomalous traffic that follows AWS best practices and minimizes application disruption.

  Which solution will meet these requirements?

  A. Use EventBridge to disable the instance profile access keys.
  B. Use EventBridge to invoke a Lambda function that removes the affected instance from the Auto Scaling group and isolates it with a restricted security group.
  C. Use Security Hub to update the subnet network ACL to block traffic.
  D. Send GuardDuty findings to Amazon SNS for email notification.
  A. Use EventBridge to disable the instance profile access keys.

  ---

  Explanation

  runs web application fleet EC2 makes Use EventBridge to invoke a Lambda function that removes the affected instance from the Auto Scaling group and isolates it with a restricted security group, the strongest match, because fleet EC2 instances Auto Scaling asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. fleet EC2 instances Auto Scaling depends on Use EventBridge to invoke a Lambda function that removes the affected instance from the Auto Scaling group and isolates it with a restricted security group, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. Auto Scaling group GuardDuty Hub is reinforced by A company runs a web application on a fleet of Amazon EC2 instances in, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  GuardDuty Hub enabled automated response also supports Use EventBridge to invoke a Lambda function that removes the affected instance from the Auto Scaling group and isolates it with a restricted security group,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. automated response anomalous traffic follows would be weaker with Use EventBridge to disable the instance profile access keys,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. traffic follows best practices minimizes separates Use Security Hub to update the subnet network ACL to block traffic, and Send GuardDuty findings to Amazon SNS for email notification, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. practices minimizes application disruption requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 226:

  A company has many S3 buckets across accounts and needs a central inventory of where sensitive data is stored. Findings should be visible to the security team from one account and should support follow-up reviews.

  A. Enable Amazon Inspector on EC2 instances and use package vulnerability findings as the inventory.
  B. Create a CloudTrail trail in each account and search for object names that appear sensitive.
  C. Configure Amazon Macie delegated administration and enable sensitive data discovery for the organization.
  D. Use AWS Backup reports to infer which buckets contain regulated data.
  A. Enable Amazon Inspector on EC2 instances and use package vulnerability findings as the inventory.

  ---

  Explanation

  many buckets central inventory where makes Configure Amazon Macie delegated administration and enable sensitive data discovery for the organization, the strongest match, because inventory where sensitive data stored asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. inventory where sensitive data stored depends on Configure Amazon Macie delegated administration and enable sensitive data discovery for the organization, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. data stored Findings should visible is reinforced by A company has many S3 buckets across accounts and needs a central inventory of, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  should visible team support follow also supports Configure Amazon Macie delegated administration and enable sensitive data discovery for the organization,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. should support follow reviews Macie would be weaker with Enable Amazon Inspector on EC2 instances and use package vulnerability findings as the inventory,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. reviews Macie delegated administration enable separates Create a CloudTrail trail in each account and search for object names that appear sensitive, and Use AWS Backup reports to infer which buckets contain regulated data, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. administration enable sensitive data discovery points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 227:

  A security engineer has designed a VPC to segment private traffic from public traffic. The VPC includes two Availability Zones. The security engineer has provisioned each Availability Zone with one private subnet and one public subnet. The security engineer has created three route tables for use with the environment.

  One route table is for the public subnets, and two route tables are for the private subnets (one route table for the private subnet in each Availability Zone).

  The security engineer discovers that all four subnets are attempting to route traffic out through the internet gateway that is attached to the VPC.

  Which combination of steps should the security engineer take to remediate this scenario? (Select TWO.)

  A. Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.
  B. Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.
  C. Modify the route tables that are associated with each of the public subnets. Create a new route for local destinations to the VPC CIDR range.
  D. Modify the route tables that are associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the NAT gateway in the public subnet of the same Availability Zone as the target of the route.
  E. Modify the route tables that are associated with each of the private subnets. Create a new route for the destination 0.0.0.0/0. Specify the internet gateway as the target of the route.
  A. Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone.
  B. Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone.

  ---

  Explanation

  designed VPC segment private traffic makes Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone, plus Modify the route tables that are associated with each of the private subnets, Create a new route for the destination 0, 0, 0, 0/0, Specify the the strongest match, because private traffic public VPC includes asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. private traffic public VPC includes depends on Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. traffic VPC includes Availability Zones is reinforced by A security engineer has designed a VPC to segment private traffic from public traffic,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  Availability Zones provisioned Zone private also supports Modify the route tables that are associated with each of the private subnets, Create a new route for the destination 0, 0, 0, 0/0, Specify the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. Availability Zone private subnet public would be weaker with Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. subnet public created route tables separates Modify the route tables that are associated with each of the public subnets, Create a new route for local destinations to the VPC CIDR range, and Modify the route tables that are associated with each of the private subnets, Create a new route for the destination 0, 0, 0, 0/0, Specify the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. created route tables environment table points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 228:

  A company allows users to download its mobile app onto their phones. The app is MQTT based and connects to AWS IoT Core to subscribe to specific client-related topics. Recently, the company discovered that some malicious attackers have been trying to get a Trojan horse onto legitimate mobile phones. The Trojan horse poses as the authentic application and uses a client ID with injected special characters to gain access to topics outside the client ' s privilege scope.

  Which combination of actions should the company take to prevent this threat? (Select TWO.)

  A. In the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core.
  B. In the application, add a client ID check. Disconnect from the server if any special character is detected.
  C. Apply an AWS IoT Core policy that allows " AWSIoTWirelessDataAccess " with the principal set to " client/${iot:Connection.Thing.ThingName} " .
  D. Apply an AWS IoT Core policy to the device to allow " iot:Connect " with the resource set to " client /${iot:ClientId} " .
  E. Apply an AWS IoT Core policy to the device to allow " iot:Connect " with the resource set to " client /${iot:Connection.Thing.ThingName} " .
  A. In the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core.
  B. In the application, add a client ID check. Disconnect from the server if any special character is detected.

  ---

  Explanation

  allows users download mobile app makes In the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core, plus Apply an AWS IoT Core policy to the device to allow " iot, Connect " with the resource set to " client /${iot, Connection, Thing, ThingName} the strongest match, because mobile app onto their phones asks for a managed AWS capability while keeping the service responsibility clear for operations teams. mobile app onto their phones depends on In the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. their phones app MQTT based is reinforced by A company allows users to download its mobile app onto their phones, The app, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  MQTT based connects IoT Core also supports Apply an AWS IoT Core policy to the device to allow " iot, Connect " with the resource set to " client /${iot, Connection, Thing, ThingName}, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. IoT Core subscribe specific client would be weaker with In the application, add a client ID check, Disconnect from the server if any special character is detected,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. specific client related topics Recently separates Apply an AWS IoT Core policy that allows "

  AWSIoTWirelessDataAccess " with the principal set to " client/${iot, Connection, Thing, ThingName} ", and Apply an AWS IoT Core policy to the device to allow " iot, Connect " with the resource set to " client /${iot,

  ClientId} ", from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. topics Recently discovered some malicious points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 229:

  A company is running a containerized application on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The application runs as several ECS services. The ECS services are in individual target groups for an internet-facing Application Load Balancer (ALB). The ALB is the origin for an Amazon CloudFront distribution. An AWS WAF web ACL is associated with the CloudFront distribution.

  Web clients access the ECS services through the CloudFront distribution. The company learns that the web clients can bypass the web ACL and can access the ALB directly.

  Which solution will prevent the web clients from directly accessing the ALB?

  A. Create an AWS PrivateLink endpoint. Specify the existing ALB as the target. Update the CloudFront distribution by setting the PrivateLink endpoint as the origin.
  B. Create a new internal ALB. Move all the ECS services to the internal ALB. Delete the internet-facing ALB. Update the CloudFront distribution by setting the internal ALB as the origin.
  C. Modify the listener rules for the existing ALB. Add a condition to forward only the requests that come from IP addresses in the CloudFront origin prefix list.
  D. Update the CloudFront distribution by adding an X-Shared-Secret custom header for the origin. Modify the listener rules for the existing ALB to forward only the requests in which the X-Shared-Secret header has the correct value.
  A. Create an AWS PrivateLink endpoint. Specify the existing ALB as the target. Update the CloudFront distribution by setting the PrivateLink endpoint as the origin.

  ---

  Explanation

  running containerized application Elastic Container makes Update the CloudFront distribution by adding an X-Shared-Secret custom header for the origin, Modify the listener rules for the existing ALB to forward only the requests the strongest match, because Elastic Container ECS cluster Fargate asks for a managed AWS capability and the design remains easier to govern across the environment. Elastic Container ECS cluster Fargate depends on Update the CloudFront distribution by adding an X-Shared-Secret custom header for the origin, Modify the listener rules for the existing ALB to forward only the requests to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. cluster Fargate application runs several is reinforced by A company is running a containerized application on an Amazon Elastic Container Service (Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  runs several ECS individual target also supports Update the CloudFront distribution by adding an X-Shared-Secret custom header for the origin, Modify the listener rules for the existing ALB to forward only the requests, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. ECS individual target groups internet would be weaker with Create an AWS PrivateLink endpoint, Specify the existing ALB as the target, Update the CloudFront distribution by setting the PrivateLink endpoint as the origin,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. groups internet facing Application Load separates Create a new internal ALB, Move all the ECS services to the internal ALB, Delete the internet-facing ALB, Update the CloudFront distribution by setting the internal and Modify the listener rules for the existing ALB, Add a condition to forward only the requests that come from IP addresses in the CloudFront origin prefix from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. Application Load Balancer ALB origin points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 230:

  A company has security requirements for Amazon Aurora MySQL databases regarding encryption, deletion protection, public access, and audit logging. The company needs continuous monitoring and real-time visibility into compliance status.

  Which solution will meet these requirements?

  A. Use AWS Audit Manager with a custom framework.
  B. Enable AWS Config and use managed rules to monitor Aurora MySQL compliance.
  C. Use AWS Security Hub configuration policies.
  D. Use EventBridge and Lambda with custom metrics.
  A. Use AWS Audit Manager with a custom framework.

  ---

  Explanation

  requirements Aurora MySQL databases regarding makes Enable AWS Config and use managed rules to monitor Aurora MySQL compliance, the strongest match, because databases regarding encryption deletion protection asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. databases regarding encryption deletion protection depends on Enable AWS Config and use managed rules to monitor Aurora MySQL compliance, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. deletion protection public access audit is reinforced by A company has security requirements for Amazon Aurora MySQL databases regarding encryption, deletion protection,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  access audit logging continuous monitoring also supports Enable AWS Config and use managed rules to monitor Aurora MySQL compliance,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. continuous monitoring real time visibility would be weaker with Use AWS Audit Manager with a custom framework,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. time visibility compliance status requirements separates Use AWS Security Hub configuration policies, and Use EventBridge and Lambda with custom metrics, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. status requirements Enable Config managed points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.