Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 241:

  A company uses AWS IAM Identity Center with SAML 2.0 federation. The company decides to change its federation source from one identity provider (IdP) to another. The underlying directory for both IdPs is Active Directory.

  Which solution will meet this requirement?

  A. Disable all existing users and groups within IAM Identity Center that were part of the federation with the original IdP.
  B. Modify the attribute mappings within the IAM Identity Center trust relationship to match information that the new IdP sends.
  C. Reconfigure all existing IAM roles in the company ' s AWS accounts to explicitly trust the new IdP as the principal.
  D. Confirm that the Network Time Protocol (NTP) clock skew is correctly set between IAM Identity Center and the new IdP endpoints.
  A. Disable all existing users and groups within IAM Identity Center that were part of the federation with the original IdP.

  ---

  Explanation

  IAM Identity Center SAML federation makes Modify the attribute mappings within the IAM Identity Center trust relationship to match information that the new IdP sends, the strongest match, because SAML federation decides change source asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. SAML federation decides change source depends on Modify the attribute mappings within the IAM Identity Center trust relationship to match information that the new IdP sends, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. change federation source identity provider is reinforced by A company uses AWS IAM Identity Center with SAML 2, 0 federation, The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  identity provider IdP another underlying also supports Modify the attribute mappings within the IAM Identity Center trust relationship to match information that the new IdP sends,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. another underlying directory both IdPs would be weaker with Disable all existing users and groups within IAM Identity Center that were part of the federation with the original IdP,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. both IdPs Active Directory requirement separates Reconfigure all existing IAM roles in the company ' s AWS accounts to explicitly trust the new IdP as the principal, and Confirm that the Network Time Protocol (NTP) clock skew is correctly set between IAM Identity Center and the new IdP endpoints, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Directory requirement Modify attribute mappings points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 242:

  A company ' s web application is hosted on Amazon EC2 instances running behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. AWS CloudTrail is enabled and stores logs in Amazon S3 and Amazon CloudWatch Logs.

  The operations team has observed some EC2 instances reboot at random. After rebooting, all access logs on the instances have been deleted. During an investigation, the operations team found that each reboot happened just after a PHP error occurred on the new-user-creation.php file. The operations team needs to view log information to determine if the company is being attacked.

  Which set of actions will identify the suspect attacker ' s IP address for future occurrences?

  A. Configure VPC Flow Logs on the subnet where the ALB is located and stream the data to CloudWatch. Search for the new-user-creation.php occurrences in CloudWatch.
  B. Configure the CloudWatch agent on the ALB and send application logs to CloudWatch Logs.
  C. Configure the ALB to export access logs to an Amazon OpenSearch Service cluster and search for the new-user-creation.php occurrences.
  D. Configure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3 bucket. Use Amazon Athena to query the logs and find the new-user-creation.php occurrences.
  A. Configure VPC Flow Logs on the subnet where the ALB is located and stream the data to CloudWatch. Search for the new-user-creation.php occurrences in CloudWatch.

  ---

  Explanation

  web application hosted EC2 instances makes Configure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3 bucket, Use Amazon Athena to query the logs the strongest match, because EC2 instances running behind Application asks for a managed AWS capability and that reduces the need for extra supervisory automation. EC2 instances running behind Application depends on Configure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3 bucket, Use Amazon Athena to query the logs to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. behind Application Load Balancer ALB is reinforced by A company ' s web application is hosted on Amazon EC2 instances running behind, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  Balancer ALB Auto Scaling group also supports Configure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3 bucket, Use Amazon Athena to query the logs, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. Scaling group WAF web ACL would be weaker with Configure VPC Flow Logs on the subnet where the ALB is located and stream the data to CloudWatch, Search for the new-user-creation, php occurrences in CloudWatch,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. web ACL associated ALB CloudTrail separates Configure the CloudWatch agent on the ALB and send application logs to CloudWatch Logs, and Configure the ALB to export access logs to an Amazon OpenSearch Service cluster and search for the new-user-creation, php occurrences, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. ALB CloudTrail enabled stores logs points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 243:

  A company uses several AWS CloudFormation stacks to handle the deployment of a suite of applications.

  The leader of the company ' s application development team notices that the stack deployments fail with permission errors when some team members try to deploy the stacks. However, other team members can deploy the stacks successfully.

  The team members access the account by assuming a role that has a specific set of permissions. All team members have permissions to perform operations on the stacks.

  Which combination of steps will ensure consistent deployment of the stacksMOST securely? (Select THREE.)

  A. Create a service role that has a composite principal that contains each service that needs the necessary permissions.
  B. Create a service role that has cloudformation.amazonaws.com as the service principal.
  C. Add policies that reference each CloudFormation stack ARN.
  D. Add policies that reference the ARNs of each AWS service that requires permissions.
  E. Update each stack to use the service role.
  F. Add a policy to each member role to allow the iam:PassRole action for the service role.
  A. Create a service role that has a composite principal that contains each service that needs the necessary permissions.
  B. Create a service role that has cloudformation.amazonaws.com as the service principal.

  ---

  Explanation

  several CloudFormation stacks handle deployment makes Create a service role that has cloudformation, amazonaws, com as the service principal, plus Update each stack to use the service role, plus Add a policy to each member role to allow the iam, PassRole action for the service role, the strongest match, because handle deployment suite applications leader asks for a managed AWS capability and that reduces the need for extra supervisory automation. handle deployment suite applications leader depends on Create a service role that has cloudformation, amazonaws, com as the service principal, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. applications leader application development team is reinforced by A company uses several AWS CloudFormation stacks to handle the deployment of a suite, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  development team notices stack deployments also supports Update each stack to use the service role,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. stack deployments fail permission errors would be weaker with Create a service role that has a composite principal that contains each service that needs the necessary permissions,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. permission errors some team members separates Add policies that reference each CloudFormation stack ARN, and Add policies that reference the ARNs of each AWS service that requires permissions, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. team members try deploy stacks points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 244:

  A company experienced a security incident caused by a vulnerable container image that was pushed from an external CI/CD pipeline into Amazon ECR.

  Which solution will prevent vulnerable images from being pushed?

  A. Enable ECR enhanced scanning with Lambda blocking.
  B. Use Amazon Inspector with EventBridge and Lambda.
  C. Integrate Amazon Inspector into the CI/CD pipeline using SBOM generation and fail the pipeline on critical findings.
  D. Enable basic continuous ECR scanning.
  A. Enable ECR enhanced scanning with Lambda blocking.

  ---

  Explanation

  experienced incident caused vulnerable container makes Integrate Amazon Inspector into the CI/CD pipeline using SBOM generation and fail the pipeline on critical findings, the strongest match, because vulnerable container image was pushed asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. vulnerable container image was pushed depends on Integrate Amazon Inspector into the CI/CD pipeline using SBOM generation and fail the pipeline on critical findings, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. was pushed external pipeline ECR is reinforced by A company experienced a security incident caused by a vulnerable container image that was, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  pipeline ECR prevent vulnerable images also supports Integrate Amazon Inspector into the CI/CD pipeline using SBOM generation and fail the pipeline on critical findings,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. vulnerable images being pushed Integrate would be weaker with Enable ECR enhanced scanning with Lambda blocking,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. pushed Integrate Inspector pipeline SBOM separates Use Amazon Inspector with EventBridge and Lambda, and Enable basic continuous ECR scanning, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. pipeline SBOM generation fail critical points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 245:

  A company in France uses Amazon Cognito with the Cognito Hosted UI as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application ' s users will come from France.

  When the company launches the application, the company ' s security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France. The security team needs a solution to perform custom validation at sign-up. Based on the results of the validation, the solution must accept or deny the registration request.

  Which combination of steps will meet these requirements? (Select TWO.)

  A. Create a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool.
  B. Use a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.
  C. Configure an app client for the application ' s Amazon Cognito user pool. Use the app client ID to validate the requests in the hosted UI.
  D. Update the application ' s Amazon Cognito user pool to configure a geographic restriction setting.
  E. Use Amazon Cognito to configure a social identity provider (IdP) to validate the requests on the hosted UI.
  A. Create a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool.
  B. Use a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.

  ---

  Explanation

  France Cognito Hosted identity broker makes Create a pre sign-up AWS Lambda trigger, Associate the Amazon Cognito function with the Amazon Cognito user pool, plus Use a geographic match rule statement to configure an AWS WAF web ACL, Associate the web ACL with the Amazon Cognito user pool, the strongest match, because Hosted identity broker sign processes asks for a managed AWS capability and that reduces the need for extra supervisory automation. Hosted identity broker sign processes depends on Create a pre sign-up AWS Lambda trigger, Associate the Amazon Cognito function with the Amazon Cognito user pool, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. sign processes marketing application expects is reinforced by A company in France uses Amazon Cognito with the Cognito Hosted UI as an, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  marketing application expects users come also supports Use a geographic match rule statement to configure an AWS WAF web ACL, Associate the web ACL with the Amazon Cognito user pool,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. application users come France launches would be weaker with Configure an app client for the application ' s Amazon Cognito user pool, Use the app client ID to validate the requests in the hosted UI,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. France launches application team observes separates Update the application ' s Amazon Cognito user pool to configure a geographic restriction setting, and Use Amazon Cognito to configure a social identity provider (IdP) to validate the requests on the hosted UI, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. team observes fraudulent sign ups points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 246:

  A company that builds document management systems recently performed a security review of its application on AWS. The review showed that uploads of documents through signed URLs into Amazon S3 could occur in the application without encryption in transit. A security engineer must implement a solution that prevents uploads that are not encrypted in transit.

  Which solution will meet this requirement?

  A. Ensure that all client implementations are using HTTPS to upload documents into the application.
  B. Configure the s3-bucket-ssl-requests-only managed rule in AWS Config.
  C. Add an S3 bucket policy that denies all S3 actions for condition "aws:SecureTransport": "false".
  D. Add an S3 bucket ACL with a grantee of AllUsers, a permission of WRITE, and a condition of secureTransport.
  A. Ensure that all client implementations are using HTTPS to upload documents into the application.

  ---

  Explanation

  builds document management systems recently makes Add an S3 bucket policy that denies all S3 actions for condition "aws, SecureTransport", "false", the strongest match, because systems recently performed review application asks for a managed AWS capability which is important when security controls must be repeatable. systems recently performed review application depends on Add an S3 bucket policy that denies all S3 actions for condition "aws, SecureTransport", "false", to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. review application showed uploads documents is reinforced by A company that builds document management systems recently performed a security review of its, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  showed uploads documents through signed also supports Add an S3 bucket policy that denies all S3 actions for condition "aws, SecureTransport", "false",, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. through signed URLs could occur would be weaker with Ensure that all client implementations are using HTTPS to upload documents into the application,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. could occur application without encryption separates Configure the s3-bucket-ssl-requests-only managed rule in AWS Config, and Add an S3 bucket ACL with a grantee of AllUsers, a permission of WRITE, and a condition of secureTransport, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. without encryption transit implement prevents points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 247:

  A company has an Amazon RDS database. The database contains sensitive data that is shared across teams in the company. The company needs a solution to detect anomalous logins to the database. The solution must notify an existing Amazon SNS topic when anomalous logins occur.

  Which solution will meet these requirements?

  A. Use AWS Trusted Advisor security checks for Amazon RDS. Create an Amazon EventBridge rule to monitor the security checks for status changes. Configure the EventBridge rule to invoke an AWS Lambda function to publish a message to the SNS topic.
  B. Enable AWS AppFabric. Connect AWS AppFabric to the RDS DB instance. Create an Amazon Data Firehose stream as the destination for the AWS AppFabric findings. Create an AWS Lambda function that is invoked by the Firehose stream to publish a message to the SNS topic.
  C. Enable Amazon GuardDuty and configure GuardDuty RDS Protection. Create an Amazon EventBridge rule to monitor GuardDuty findings of anomalous logins. Configure the SNS topic as the target of the EventBridge rule.
  D. Enable Amazon Inspector. Create an Amazon EventBridge rule to monitor Amazon Inspector findings of anomalous logins. Configure the SNS topic as the target of the EventBridge rule.
  A. Use AWS Trusted Advisor security checks for Amazon RDS. Create an Amazon EventBridge rule to monitor the security checks for status changes. Configure the EventBridge rule to invoke an AWS Lambda function to publish a message to the SNS topic.

  ---

  Explanation

  RDS database contains sensitive data makes Enable Amazon GuardDuty and configure GuardDuty RDS Protection, Create an Amazon EventBridge rule to monitor GuardDuty findings of anomalous logins, Configure the SNS topic as the the strongest match, because contains sensitive data shared teams asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. contains sensitive data shared teams depends on Enable Amazon GuardDuty and configure GuardDuty RDS Protection, Create an Amazon EventBridge rule to monitor GuardDuty findings of anomalous logins, Configure the SNS topic as the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. shared teams detect anomalous logins is reinforced by A company has an Amazon RDS database, The database contains sensitive data that is, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  anomalous logins database notify SNS also supports Enable Amazon GuardDuty and configure GuardDuty RDS Protection, Create an Amazon EventBridge rule to monitor GuardDuty findings of anomalous logins, Configure the SNS topic as the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. notify SNS topic anomalous logins would be weaker with Use AWS Trusted Advisor security checks for Amazon RDS, Create an Amazon EventBridge rule to monitor the security checks for status changes, Configure the EventBridge rule, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the

  protection aligned with the stated AWS boundary. anomalous logins occur requirements Enable separates Enable AWS AppFabric, Connect AWS AppFabric to the RDS DB instance, Create an Amazon Data Firehose stream as the destination for the AWS AppFabric findings, Create and Enable Amazon Inspector, Create an Amazon EventBridge rule to monitor Amazon Inspector findings of anomalous logins, Configure the SNS topic as the target of the EventBridge from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. requirements Enable GuardDuty RDS Protection points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 248:

  A company uses AWS Organizations and requires that account activity logging cannot be stopped by workload administrators. The security team also wants an automated way to restore logging if a trail is accidentally disabled.

  Which combination of controls should the company use? Choose two.

  A. Attach an SCP that denies actions that stop or delete required trails.
  B. Use AWS Config remediation to re-enable required CloudTrail logging.
  C. Store CloudTrail logs only on the local file system of each instance.
  D. Disable log file validation to reduce write failures.
  E. Give every account administrator permission to update the organization trail.
  A. Attach an SCP that denies actions that stop or delete required trails.
  B. Use AWS Config remediation to re-enable required CloudTrail logging.

  ---

  Explanation

  Organizations requires activity logging cannot makes Attach an SCP that denies actions that stop or delete required trails, plus Use AWS Config remediation to re-enable required CloudTrail logging, the strongest match, because logging cannot stopped workload administrators asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. logging cannot stopped workload administrators depends on Attach an SCP that denies actions that stop or delete required trails, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. workload administrators team also wants is reinforced by A company uses AWS Organizations and requires that account activity logging cannot be stopped, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  also wants automated way restore also supports Use AWS Config remediation to re-enable required CloudTrail logging,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. way restore logging trail accidentally would be weaker with Store CloudTrail logs only on the local file system of each instance,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. trail accidentally disabled combination controls separates Disable log file validation to reduce write failures, and Give every account administrator permission to update the organization trail, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. combination controls should Choose Attach points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 249:

  A company rapidly adopted many AWS services without a formal architecture review. Leadership asks the security team to evaluate the workload against AWS security best practices, identify high-risk issues, and track improvement milestones with the application owners.

  A. Use Amazon Detective to create a behavior graph for every architecture component and mark missing components as high risk.
  B. Create a workload in the AWS Well-Architected Tool and review the security pillar with the application owners.
  C. Use AWS Cost Explorer to rank security priorities by monthly spend only.
  D. Use AWS Artifact to generate a custom threat model for the workload.
  A. Use Amazon Detective to create a behavior graph for every architecture component and mark missing components as high risk.

  ---

  Explanation

  rapidly adopted many without formal makes Create a workload in the AWS Well-Architected Tool and review the security pillar with the application owners, the strongest match, because without formal architecture review Leadership asks for a managed AWS capability and that reduces the need for extra supervisory automation. without formal architecture review Leadership depends on Create a workload in the AWS Well-Architected Tool and review the security pillar with the application owners, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. review Leadership asks team evaluate is reinforced by A company rapidly adopted many AWS services without a formal architecture review, Leadership asks, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  team evaluate workload against best also supports Create a workload in the AWS Well-Architected Tool and review the security pillar with the application owners,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. against best practices identify high would be weaker with Use Amazon Detective to create a behavior graph for every architecture component and mark missing components as high risk,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. identify high risk issues track separates Use AWS Cost Explorer to rank security priorities by monthly spend only, and Use AWS Artifact to generate a custom threat model for the workload, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. issues track improvement milestones application points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 250:

  A company runs an application on a fleet of Amazon EC2 instances. The company can remove instances from the fleet without risk to the application. All EC2 instances use the same security group named ProdFleet. Amazon GuardDuty and AWS Config are active in the company ' s AWS account.

  A security engineer needs to provide a solution that will prevent an EC2 instance from sending outbound traffic if GuardDuty generates a cryptocurrency finding event. The security engineer creates a new security group named Isolate that contains no outbound rules. The security engineer configures an AWS Lambda function to remove an EC2 instance from the ProdFleet security group and add it to the Isolate security group.

  Which additional step will meet this requirement?

  A. Configure GuardDuty to directly invoke the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.
  B. Configure an AWS Config rule that invokes the Lambda function if a CryptoCurrency:EC2/* configuration change event occurs for an EC2 instance.
  C. Configure an Amazon EventBridge rule that invokes the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.
  D. Configure an Amazon EventBridge rule that invokes the Lambda function if AWS Config detects a CryptoCurrency:EC2/* configuration change event for an EC2 instance.
  A. Configure GuardDuty to directly invoke the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.

  ---

  Explanation

  runs application fleet EC2 instances makes Configure an Amazon EventBridge rule that invokes the Lambda function if GuardDuty generates a CryptoCurrency, EC2/* finding event, the strongest match, because EC2 instances remove fleet without asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. EC2 instances remove fleet without depends on Configure an Amazon EventBridge rule that invokes the Lambda function if GuardDuty generates a CryptoCurrency, EC2/* finding event, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. instances fleet without risk application is reinforced by A company runs an application on a fleet of Amazon EC2 instances, The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  risk application EC2 instances same also supports Configure an Amazon EventBridge rule that invokes the Lambda function if GuardDuty generates a CryptoCurrency, EC2/* finding event,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. instances same group named ProdFleet would be weaker with Configure GuardDuty to directly invoke the Lambda function if GuardDuty generates a CryptoCurrency, EC2/* finding event,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. named ProdFleet GuardDuty Config active separates Configure an AWS Config rule that invokes the Lambda function if a CryptoCurrency, EC2/* configuration change event occurs for an EC2 instance, and Configure an Amazon EventBridge rule that invokes the Lambda function if AWS Config detects a CryptoCurrency, EC2/* configuration change event for an EC2 instance, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Config active provide

  prevent EC2 points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.