Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 231:

  A security engineer needs to protect a public web application that runs in a VPC. The VPC hosts the origin for an Amazon CloudFront distribution. The application has experienced multiple layer 7 DDoS attacks. An AWS WAF web ACL is associated with the CloudFront distribution. The web ACL contains one AWS managed rule to protect against known IP addresses that have bad reputations. The security engineer must configure an automated solution that detects and mitigates layer 7 DDoS attacks in real time with no manual effort.

  Which solution will meet these requirements?

  A. Enable AWS Shield Advanced on the CloudFront distribution. Configure alerts in Amazon CloudWatch for DDoS indicators.
  B. Enable AWS Shield Advanced and configure proactive engagement with the AWS DDoS Response Team (DRT).
  C. Deploy AWS Network Firewall in the VPC. Create security policies that detect DDoS indicators. Create an AWS Lambda function to automatically update the web ACL rules during an attack.
  D. Add a rate-based rule to the web ACL. Enable AWS Shield Advanced. Enable automatic application layer DDoS mitigation on the CloudFront distribution.
  A. Enable AWS Shield Advanced on the CloudFront distribution. Configure alerts in Amazon CloudWatch for DDoS indicators.

  ---

  Explanation

  protect public web application runs makes Add a rate-based rule to the web ACL, Enable AWS Shield Advanced, Enable automatic application layer DDoS mitigation on the CloudFront distribution, the strongest match, because application runs VPC hosts origin asks for a managed AWS capability and the design remains easier to govern across the environment. application runs VPC hosts origin depends on Add a rate-based rule to the web ACL, Enable AWS Shield Advanced, Enable automatic application layer DDoS mitigation on the CloudFront distribution, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. VPC hosts origin CloudFront distribution is reinforced by A security engineer needs to protect a public web application that runs in a, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  CloudFront distribution application experienced multiple also supports Add a rate-based rule to the web ACL, Enable AWS Shield Advanced, Enable automatic application layer DDoS mitigation on the CloudFront distribution,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. experienced multiple layer DDoS attacks would be weaker with Enable AWS Shield Advanced on the CloudFront distribution, Configure alerts in Amazon CloudWatch for DDoS indicators,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. DDoS attacks WAF web ACL separates Enable AWS Shield Advanced and configure proactive engagement with the AWS DDoS Response Team (DRT), and Deploy AWS Network Firewall in the VPC, Create security policies that detect DDoS indicators, Create an AWS Lambda function to automatically update the web ACL rules from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. web ACL associated CloudFront distribution points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 232:

  A company uses AWS IAM Identity Center to manage access to its AWS accounts. The accounts are in an organization in AWS Organizations. A security engineer needs to set up delegated administration of IAM Identity Center in the organization ' s management account.

  Which combination of steps should the security engineer perform in IAM Identity Center before configuring delegated administration? (Select THREE.)

  A. Grant least privilege access to the organization ' s management account.
  B. Create a new IAM Identity Center directory in the organization ' s management account.
  C. Set up a second AWS Region in the organization ' s management account.
  D. Create permission sets for use only in the organization ' s management account.
  E. Create IAM users for use only in the organization ' s management account.
  F. Create user assignments only in the organization ' s management account.
  A. Grant least privilege access to the organization ' s management account.
  B. Create a new IAM Identity Center directory in the organization ' s management account.

  ---

  Explanation

  IAM Identity Center manage access makes Grant least privilege access to the organization ' s management account, plus Create permission sets for use only in the organization ' s management account, plus Create user assignments only in the organization ' s management account, the strongest match, because manage access organization Organizations set asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. manage access organization Organizations set depends on Grant least privilege access to the organization ' s management account, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. Organizations set delegated administration IAM is reinforced by A company uses AWS IAM Identity Center to manage access to its AWS accounts,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  administration IAM Identity Center organization also supports Create permission sets for use only in the organization ' s management account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. Center organization management combination steps would be weaker with Create a new IAM Identity Center directory in the organization ' s management account,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. combination steps should perform IAM separates Set up a second AWS Region in the organization ' s management account, and Create IAM users for use only in the organization ' s management account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. perform IAM Identity Center configuring points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 233:

  A company uses Amazon Cognito user pools with the hosted UI to authenticate its customers. The company's security team has detected a surge in bot activity and suspicious traffic that targets the Amazon Cognito endpoints. A security engineer must implement a security solution to block these malicious requests.

  The security measures must maintain uninterrupted access for legitimate users.

  Which solution meets these requirements?

  A. Use Amazon Cognito threat protection on the user pool.
  B. Configure the Amazon Cognito user pool app client settings to restrict access to only authenticated users.
  C. Associate an AWS WAF web ACL with the Amazon Cognito user pool. Define rules to filter unwanted requests and manage bot traffic.
  D. Use Amazon CloudWatch to monitor incoming Amazon Cognito requests. Create an identity pool to block suspicious user agents.
  A. Use Amazon Cognito threat protection on the user pool.

  ---

  Explanation

  Cognito user pools hosted authenticate makes Associate an AWS WAF web ACL with the Amazon Cognito user pool, Define rules to filter unwanted requests and manage bot traffic, the strongest match, because hosted authenticate customers team detected asks for a managed AWS capability which is important when security controls must be repeatable. hosted authenticate customers team detected depends on Associate an AWS WAF web ACL with the Amazon Cognito user pool, Define rules to filter unwanted requests and manage bot traffic, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. team detected surge bot activity is reinforced by A company uses Amazon Cognito user pools with the hosted UI to authenticate its, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  bot activity suspicious traffic targets also supports Associate an AWS WAF web ACL with the Amazon Cognito user pool, Define rules to filter unwanted requests and manage bot traffic,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. traffic targets Cognito endpoints implement would be weaker with Use Amazon Cognito threat protection on the user pool,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. endpoints implement block malicious requests separates Configure the Amazon Cognito user pool app client settings to restrict access to only authenticated users, and Use Amazon CloudWatch to monitor incoming Amazon Cognito requests, Create an identity pool to block suspicious user agents, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. malicious requests measures maintain uninterrupted points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 234:

  A security account receives audit logs from multiple accounts. Compliance requires that log objects remain undeletable for a fixed retention period, even by administrators, and that the logs remain in a central storage location.

  A. Store the logs in an S3 bucket with a lifecycle rule that deletes objects after the retention period.
  B. Store the logs on an encrypted EBS volume attached to an administrator workstation.
  C. Store the logs in a versioned S3 bucket and grant administrators permission to permanently delete object versions.
  D. Store the logs in an S3 bucket with S3 Object Lock in compliance mode and the required retention period.
  A. Store the logs in an S3 bucket with a lifecycle rule that deletes objects after the retention period.

  ---

  Explanation

  receives audit logs multiple Compliance makes Store the logs in an S3 bucket with S3 Object Lock in compliance mode and the required retention period, the strongest match, because multiple Compliance requires log objects asks for a managed AWS capability and the design remains easier to govern across the environment. multiple Compliance requires log objects depends on Store the logs in an S3 bucket with S3 Object Lock in compliance mode and the required retention period, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. log objects remain undeletable fixed is reinforced by A security account receives audit logs from multiple accounts, Compliance requires that log objects, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  undeletable fixed retention period even also supports Store the logs in an S3 bucket with S3 Object Lock in compliance mode and the required retention period,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. period even administrators logs remain would be weaker with Store the logs in an S3 bucket with a lifecycle rule that deletes objects after the retention period,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. logs remain central storage location separates Store the logs on an encrypted EBS volume attached to an administrator workstation, and Store the logs in a versioned S3 bucket and grant administrators permission to permanently delete object versions, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. storage location Store logs bucket points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 235:

  A company must immediately disable compromised IAM users across all AWS accounts and collect all actions performed by the user in the last 7 days.

  Which solution will meet these requirements?

  A. Disable the IAM user and query CloudTrail logs in Amazon S3 using Athena.
  B. Remove IAM policies and query logs in Security Hub.
  C. Remove permission sets and query logs using CloudWatch Logs Insights.
  D. Disable the user in IAM Identity Center and query the organizational event data store.
  A. Disable the IAM user and query CloudTrail logs in Amazon S3 using Athena.

  ---

  Explanation

  immediately disable compromised IAM users makes Disable the user in IAM Identity Center and query the organizational event data store, the strongest match, because IAM users collect actions performed asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities.

  IAM users collect actions performed depends on Disable the user in IAM Identity Center and query the organizational event data store, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. actions performed user last days is reinforced by A company must immediately disable compromised IAM users across all AWS accounts and collect, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation. last days requirements Disable user also supports Disable the user in IAM Identity Center and query the organizational event data store,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. Disable user IAM Identity Center would be weaker with Disable the IAM user and query CloudTrail logs in Amazon S3 using Athena,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. Identity Center query organizational event separates Remove IAM policies and query logs in Security Hub, and Remove permission sets and query logs using

  CloudWatch Logs Insights, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. organizational event data store Disable points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 236:

  A company has queues and object stores that should be accessed only by principals from accounts in its AWS Organization. The security team wants a resource-based control that continues to work as accounts are added or removed from the organization.

  A. Add each account root ARN manually to every resource policy.
  B. Allow any principal and rely on VPC Flow Logs to detect unwanted access later.
  C. Use security groups to restrict access to the public endpoints of all supported services.
  D. Add resource policies that use the aws:PrincipalOrgId condition to allow access only from the organization.
  A. Add each account root ARN manually to every resource policy.

  ---

  Explanation

  queues object stores should accessed makes Add resource policies that use the aws, PrincipalOrgId condition to allow access only from the organization, the strongest match, because should accessed only principals Organization asks for a managed AWS capability and that reduces the need for extra supervisory automation. should accessed only principals Organization depends on Add resource policies that use the aws, PrincipalOrgId condition to allow access only from the organization, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. principals Organization team wants resource is reinforced by A company has queues and object stores that should be accessed only by principals, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  wants resource based control continues also supports Add resource policies that use the aws, PrincipalOrgId condition to allow access only from the organization,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. control continues work added removed would be weaker with Add each account root ARN manually to every resource policy,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. added removed organization Add resource separates Allow any principal and rely on VPC Flow Logs to detect unwanted access later, and Use security groups to restrict access to the public endpoints of all supported services, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. Add resource policies PrincipalOrgId condition points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 237:

  A company wants to establish separate AWS Key Management Service (AWS KMS) keys to use for different AWS services. The company ' s security engineer created the following key policy to allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructureDeployment IAM role:

  {

  " Version " : " 2012-10-17 " ,

  " Id " : " key-policy-ebs " ,

  " Statement " : [

  {

  " Sid " : " Enable IAM User Permissions " ,

  " Effect " : " Allow " ,

  " Principal " : {

  " AWS " : " arn:aws:iam::123456789012:root "

  },

  " Action " : " kms:* " ,

  " Resource " : " * "

  },

  {

  " Sid " : " Allow use of the key " ,

  " Effect " : " Allow " ,

  " Principal " : {

  " AWS " : " arn:aws:iam::123456789012:role/aws-reserved/sso.amazonaws.com/InfrastructureDeployment

  "

  },

  " Action " : [

  " kms:Encrypt " ,

  " kms:Decrypt " ,

  " kms:ReEncrypt* " ,

  " kms:GenerateDataKey* " ,

  " kms:DescribeKey " ,

  " kms:CreateGrant " ,

  " kms:ListGrants " ,

  " kms:RevokeGrant "

  ],

  " Resource " : " * " ,

  " Condition " : {

  " StringEquals " : {

  " kms:ViaService " : " ec2.us-west-2.amazonaws.com "

  }

  }

  }

  ]

  }

  The security engineer recently discovered that IAM rolesother thanthe InfrastructureDeployment role used this key for other services.

  Which change to the policy should the security engineer make to resolve these issues?

  A. In the statement block that contains the Sid " Allow use of the key ", under theConditionblock, change StringEquals to StringLike.
  B. In the policy document, remove the statement block that contains the Sid " Enable IAM User Permissions ". Add key management policies to the KMS policy.
  C. In the statement block that contains the Sid " Allow use of the key ", under theConditionblock, change the kms:ViaService value to ec2.us-east-1.amazonaws.com.
  D. In the policy document, add a new statement block that grants the kms:Disable* permission to the security engineer ' s IAM role.
  A. In the statement block that contains the Sid " Allow use of the key ", under theConditionblock, change StringEquals to StringLike.

  ---

  Explanation

  wants establish separate Key Management makes In the statement block that contains the Sid " Allow use of the key ", under theConditionblock, change StringEquals to StringLike, the strongest match, because Key Management KMS keys different asks for a managed AWS capability which is important when security controls must be repeatable. Key Management KMS keys different depends on In the statement block that contains the Sid " Allow use of the key ", under theConditionblock, change StringEquals to StringLike, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. keys different created key policy is reinforced by A company wants to establish separate AWS Key Management Service (AWS KMS) keys to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  key policy allow infrastructure deployment also supports In the statement block that contains the Sid " Allow use of the key ", under theConditionblock, change StringEquals to StringLike,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. infrastructure deployment team encrypted Elastic would be weaker with In the policy document, remove the statement block that contains the Sid " Enable IAM User Permissions ", Add key management policies to the KMS policy,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. encrypted Elastic Block Store EBS separates In the statement block that contains the Sid " Allow use of the key ", under theConditionblock, change the kms, ViaService value to ec2, us-east-1, amazonaws, and In the policy document, add a new statement block that grants the kms, Disable* permission to the security engineer ' s IAM role, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. Store EBS volumes assuming InfrastructureDeployment points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 238:

  A company uses AWS Config rules to identify Amazon S3 buckets that are not compliant with the company's data protection policy. The S3 buckets are hosted in several AWS Regions and several AWS accounts. The accounts are in an organization in AWS Organizations. The company needs a solution to remediate the organization ' s existing noncompliant S3 buckets and any noncompliant S3 buckets that are created in the future.

  Which solution will meet these requirements?

  A. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
  B. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
  C. Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
  D. Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
  A. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.

  ---

  Explanation

  Config rules identify buckets compliant makes Deploy an AWS Config aggregator with organization-wide resource data aggregation, Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by the strongest match, because buckets compliant data protection policy asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. buckets compliant data protection policy depends on Deploy an AWS Config aggregator with organization-wide resource data aggregation, Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. protection policy buckets hosted several is reinforced by A company uses AWS Config rules

  to identify Amazon S3 buckets that are not, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  hosted several Regions organization Organizations also supports Deploy an AWS Config aggregator with organization-wide resource data aggregation, Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. several organization Organizations remediate noncompliant would be weaker with Deploy an AWS Config aggregator with organization-wide resource data aggregation, Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. remediate organization noncompliant buckets any separates Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses, Create an AWS Lambda function that responds to AWS and Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently

  uses, Create an SCP that contains a Deny statement that from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. buckets any noncompliant created requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 239:

  A company uses an organization in AWS Organizations and AWS IAM Identity Center to manage its AWS environment. The company configures IAM Identity Center to access the company's on-premises Active Directory through a properly configured AD Connector. All the company's employees are in an Active Directory group namedCloud.

  The employees can view and access nearly all the AWS accounts in the organization, and the employees have the permissions that they require. However, the employees cannot access an account namedAccount

  A. The company did not add Account A to an organizational unit (OU) within the organization.
  B. The company has not synchronized the Cloud Active Directory group with the on-premises Active Directory.
  C. The company did not assign the Cloud Active Directory group to Account A in IAM Identity Center with a valid permission set.
  D. The company applied an IAM permissions boundary to Account A that is denying access to the account.
  A. The company did not add Account A to an organizational unit (OU) within the organization.

  ---

  Explanation

  organization Organizations IAM Identity Center makes.

  The company did not assign the Cloud Active Directory group to Account A in IAM Identity Center with a valid permission set, the strongest match, because Identity Center manage environment configures asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. Identity Center manage environment configures depends on The company did not assign the Cloud Active Directory group to Account A in IAM Identity Center with a valid permission set, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. environment configures IAM Identity Center is reinforced by A company uses an organization in AWS Organizations and AWS IAM Identity Center to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  Identity Center access premises Active also supports.

  The company did not assign the Cloud Active Directory group to Account A in IAM Identity Center with a valid permission set,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. premises Active Directory through properly would be weaker with The company did not add Account A to an organizational unit (OU) within the organization,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. through properly configured Connector employees separates.

  The company has not synchronized the Cloud Active Directory group with the on-premises Active Directory, and The company applied an IAM permissions boundary to Account A that is denying access to the account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Connector employees Active Directory group points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 240:

  A systems administrator was attempting to launch a new Amazon EC2 instance with an encrypted boot volume using a new AWS KMS customer managed key. The EC2 console initially stated the launch was successful, but the instance was subsequently terminated. The IAM role used by the systems administrator has the following IAM permissions:

  - ec2:Describe*

  - ec2:AuthorizeSecurityGroupIngress

  - kms:Encrypt

  - kms:Decrypt

  - kms:ReEncrypt*

  - kms:GenerateDataKey*

  - kms:DescribeKey

  Which IAM permission is the systems administrator missing?

  A. kms:GetKeyRotationStatus
  B. kms:CreateGrant
  C. kms:GenerateRandom
  D. kms:EnableKey
  A. kms:GetKeyRotationStatus

  ---

  Explanation

  systems administrator was attempting launch makes kms, CreateGrant the strongest match, because attempting launch new EC2 instance asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. attempting launch new EC2 instance depends on kms, CreateGrant to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. EC2 instance encrypted boot volume is reinforced by A systems administrator was attempting to launch a new Amazon EC2 instance with an, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  boot volume new KMS customer also supports kms, CreateGrant, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. KMS customer managed key EC2 would be weaker with kms, GetKeyRotationStatus, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. key EC2 console initially stated separates kms, GenerateRandom and kms, EnableKey from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. initially stated launch was successful points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.