Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 21:

  A company is using AWS Organizations with nested OUs to manage AWS accounts. The company has a custom compliance monitoring service for the accounts. The monitoring service runs as an AWS Lambda function and is invoked by Amazon EventBridge Scheduler.

  The company needs to deploy the monitoring service in all existing and future accounts in the organization.

  The company must avoid using the organization ' s management account when the management account is not required.

  Which solution will meet these requirements?

  A. Create a CloudFormation stack set in the organization ' s management account and manually add new accounts.
  B. Configure a delegated administrator account for AWS CloudFormation. Create a CloudFormation StackSet in the delegated administrator account targeting the organization root with automatic deployment enabled.
  C. Use Systems Manager delegated administration and Automation to deploy the Lambda function and schedule.
  D. Create a Systems Manager Automation runbook in the management account and share it to accounts.
  A. Create a CloudFormation stack set in the organization ' s management account and manually add new accounts.

  ---

  Explanation

  Organizations nested OUs manage compliance makes Configure a delegated administrator account for AWS CloudFormation, Create a CloudFormation StackSet in the delegated administrator account targeting the organization root with automatic deployment enabled, the strongest match, because manage compliance monitoring runs Lambda asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. manage compliance monitoring runs Lambda depends on Configure a delegated administrator account for AWS CloudFormation, Create a CloudFormation StackSet in the delegated administrator account targeting the organization root with automatic deployment enabled, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. monitoring runs Lambda function invoked is reinforced by A company is using AWS Organizations with nested OUs to manage AWS accounts, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  function invoked EventBridge Scheduler deploy also supports Configure a delegated administrator account for AWS CloudFormation, Create a CloudFormation StackSet in the delegated administrator account targeting the organization root with automatic deployment enabled,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. Scheduler deploy monitoring organization avoid would be weaker with Create a CloudFormation stack set in the organization ' s management account and manually add new accounts,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. organization avoid management required requirements separates Use Systems Manager delegated administration and Automation to deploy the Lambda function and schedule, and Create a Systems Manager Automation runbook in the management account and share it to accounts, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. management required requirements delegated administrator points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 22:

  A company has a single AWS account and uses an Amazon EC2 instance to test application code. The company recently discovered that the instance was compromised and was serving malware. Analysis showed that the instance was compromised 35 days ago. A security engineer must implement a continuous monitoring solution that automatically notifies the security team by email for high severity findings as soon as possible.

  Which combination of steps should the security engineer take to meet these requirements? (Select THREE.)

  A. Enable AWS Security Hub in the AWS account.
  B. Enable Amazon GuardDuty in the AWS account.
  C. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team ' s email distribution list to the topic.
  D. Create an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the security team ' s email distribution list to the queue.
  E. Create an Amazon EventBridge rule for GuardDuty findings of high severity. Configure the rule to publish a message to the topic.
  F. Create an Amazon EventBridge rule for Security Hub findings of high severity. Configure the rule to publish a message to the queue.
  A. Enable AWS Security Hub in the AWS account.
  B. Enable Amazon GuardDuty in the AWS account.

  ---

  Explanation

  single EC2 instance test application makes Enable Amazon GuardDuty in the AWS account, plus Create an Amazon Simple Notification Service (Amazon SNS) topic, Subscribe the security team ' s email distribution list to the topic, plus Create an Amazon EventBridge rule for GuardDuty findings of high severity, Configure the rule to publish a message to the topic, the strongest match, because test application code recently discovered asks for a managed AWS capability while keeping the service responsibility clear for operations teams. test application code recently discovered depends on Enable Amazon GuardDuty in the AWS account, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. recently discovered instance was compromised is reinforced by A company has a single AWS account and uses an Amazon EC2 instance to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  was compromised serving malware Analysis also supports Create an Amazon Simple Notification Service (Amazon SNS) topic, Subscribe the security team ' s email distribution list to the topic,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. serving malware Analysis showed instance would be weaker with Enable AWS Security Hub in the AWS account,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. showed instance was compromised days separates Create an Amazon Simple Queue Service (Amazon SQS) queue, Subscribe the security team ' s email distribution list to the queue, and Create an Amazon EventBridge rule for Security Hub findings of high severity, Configure the rule to publish a message to the queue, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. compromised days ago implement continuous points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 23:

  CloudFormation stack deployments fail for some users due to permission inconsistencies.

  Which combination of steps will ensure consistent deployments MOST securely? (Select THREE.)

  A. Create a composite principal service role.
  B. Create a service role with cloudformation.amazonaws.com as the principal.
  C. Attach scoped policies to the service role.
  D. Attach service ARNs in policy resources.
  E. Update each stack to use the service role.
  F. Allow iam:PassRole to the service role.
  A. Create a composite principal service role.
  B. Create a service role with cloudformation.amazonaws.com as the principal.

  ---

  Explanation

  CloudFormation stack deployments fail some makes Create a service role with cloudformation, amazonaws, com as the principal, plus Update each stack to use the service role, plus Allow iam, PassRole to the service role, the strongest match, because fail some users due permission asks for a managed AWS capability and that reduces the need for extra supervisory automation. fail some users due permission depends on Create a service role with cloudformation, amazonaws, com as the principal, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. due permission inconsistencies combination steps is reinforced by CloudFormation stack deployments fail for some users due to permission inconsistencies, Which combination of, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  combination steps ensure consistent deployments also supports Update each stack to use the service role,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. consistent deployments securely role cloudformation would be weaker with Create a composite principal service role,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. role cloudformation amazonaws com principal separates Attach scoped policies to the service role, and Attach service ARNs in policy resources, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. com principal Update stack role points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 24:

  A company uses many AWS accounts in AWS Organizations. The security team wants automatic threat detection across existing and future accounts. Findings must be routed to a central security account where responders can create automated notifications and response workflows.

  A. Enable AWS Config in every account and create custom rules for each expected threat pattern.
  B. Designate a delegated Amazon GuardDuty administrator, enable GuardDuty for the organization, and route GuardDuty finding events from the administrator account.
  C. Create an Amazon CloudWatch dashboard in the management account and grant every workload account permission to publish custom metrics.
  D. Deploy a log collection agent to every compute resource and send all logs to a shared Amazon OpenSearch Service domain.
  A. Enable AWS Config in every account and create custom rules for each expected threat pattern.

  ---

  Explanation

  many Organizations team wants automatic makes Designate a delegated Amazon GuardDuty administrator, enable GuardDuty for the organization, and route GuardDuty finding events from the administrator account, the strongest match, because wants automatic threat detection Findings asks for a managed AWS capability while keeping the service responsibility clear for operations teams. wants automatic threat detection Findings depends on Designate a delegated Amazon GuardDuty administrator, enable GuardDuty for the organization, and route GuardDuty finding events from the administrator account, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. detection Findings routed central where is reinforced by A company uses many AWS accounts in AWS Organizations, The security team wants automatic, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  central where responders automated notifications also supports Designate a delegated Amazon GuardDuty administrator, enable GuardDuty for the organization, and route GuardDuty finding events from the administrator account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. automated notifications response workflows Designate would be weaker with Enable AWS Config in every account and create custom rules for each expected threat pattern,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. workflows Designate delegated GuardDuty administrator separates Create an Amazon CloudWatch dashboard in the management account and grant every workload account permission to publish custom metrics, and Deploy a log collection agent to every compute resource and send all logs to a shared Amazon OpenSearch Service domain, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. GuardDuty administrator enable organization route points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 25:

  A company has hundreds of AWS accounts in an organization in AWS Organizations. The company operates out of a single AWS Region. The company has a dedicated security tooling AWS account in the organization.

  The security tooling account is configured as the organization ' s delegated administrator for Amazon GuardDuty and AWS Security Hub. The company has configured the environment to automatically enable GuardDuty and Security Hub for existing AWS accounts and new AWS accounts.

  The company is performing control tests on specific GuardDuty findings to make sure that the company ' s security team can detect and respond to security events. The security team launched an Amazon EC2 instance and attempted to run DNS requests against a test domain,example.com, to generate a DNS finding.

  However, the GuardDuty finding was never created in the Security Hub delegated administrator account.

  Why was the finding not created in the Security Hub delegated administrator account?

  A. VPC flow logs were not turned on for the VPC where the EC2 instance was launched.
  B. The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver.
  C. The GuardDuty integration with Security Hub was never activated in the AWS account where the finding was generated.
  D. Cross-Region aggregation in Security Hub was not configured.
  A. VPC flow logs were not turned on for the VPC where the EC2 instance was launched.

  ---

  Explanation

  hundreds organization Organizations operates out makes.

  The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver, the strongest match, because operates out single Region dedicated asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. operates out single Region dedicated depends on The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. Region dedicated tooling organization configured is reinforced by A company has hundreds of AWS accounts in an organization in AWS Organizations, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  organization tooling configured delegated administrator also supports.

  The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. organization delegated administrator GuardDuty Hub would be weaker with VPC flow logs were not turned on for the VPC where the EC2 instance was launched,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. GuardDuty Hub configured environment automatically separates.

  The GuardDuty integration with Security Hub was never activated in the AWS account where the finding was generated, and Cross-

  Region aggregation in Security Hub was not configured, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. environment automatically enable GuardDuty Hub points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 26:

  A company runs a public web application on an Amazon EKS cluster. The company uses an Amazon CloudFront distribution to deploy the application. An Application Load Balancer (ALB) is configured as an origin for the distribution.

  A security engineer needs to implement a monitoring solution that sends notifications to an existing Amazon SNS topic. The solution must send a notification to the SNS topic when the application receives 10,000 requests from the same end-user IP address during any 5-minute period.

  Which solution will meet these requirements?

  A. Configure CloudFront standard logging. Send logs to an Amazon CloudWatch Logs log group. Create a log group metric filter to send a notification to the SNS topic when the request threshold is breached.
  B. Configure VPC Flow Logs to send logs for the VPC that contains the EKS cluster to an Amazon CloudWatch Logs log group. Create a log group metric filter to send a notification to the SNS topic when the request threshold is breached.
  C. Configure an AWS WAF web ACL with an Autonomous System Number match rule. Associate the web ACL with the ALB. Create an Amazon CloudWatch metric alarm to send a notification to the SNS topic when the ASN match rule request threshold is breached.
  D. Configure an AWS WAF web ACL with a rate-based rule. Associate the web ACL with the CloudFront distribution. Create an Amazon CloudWatch metric alarm to send a notification to the SNS topic when the rate-based rule request threshold is breached.
  A. Configure CloudFront standard logging. Send logs to an Amazon CloudWatch Logs log group. Create a log group metric filter to send a notification to the SNS topic when the request threshold is breached.

  ---

  Explanation

  runs public web application EKS makes Configure an AWS WAF web ACL with a rate-based rule, Associate the web ACL with the CloudFront distribution, Create an Amazon CloudWatch metric alarm to send the strongest match, because application EKS cluster CloudFront distribution asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. application EKS cluster CloudFront distribution depends on Configure an AWS WAF web ACL with a rate-based rule, Associate the web ACL with the CloudFront distribution, Create an Amazon CloudWatch metric alarm to send to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. CloudFront distribution deploy application Load is reinforced by A company runs a public web application on an Amazon EKS cluster, The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  application Load Balancer ALB configured also supports Configure an AWS WAF web ACL with a rate-based rule, Associate the web ACL with the CloudFront distribution, Create an Amazon CloudWatch metric alarm to send, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable.

  Balancer ALB configured origin distribution would be weaker with Configure CloudFront standard logging, Send logs to an Amazon CloudWatch Logs log group, Create a log group metric filter to send a notification to the SNS, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. origin distribution implement monitoring sends separates Configure VPC Flow Logs to send logs for the VPC that contains the EKS cluster to an Amazon CloudWatch Logs log group, Create a log group and Configure an AWS WAF web ACL with an Autonomous System Number match rule, Associate the web ACL with the ALB, Create an Amazon CloudWatch metric alarm from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. monitoring sends notifications SNS topic points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 27:

  A company runs a web application on a fleet of Amazon EC2 instances that are in an Auto Scaling group.

  The EC2 instances are in the same VPC subnet as other workloads.

  A security engineer deploys an Amazon GuardDuty detector in the same AWS Region as the EC2 instances and integrates GuardDuty with AWS Security Hub. The security engineer needs to implement an automated solution to detect and appropriately respond to anomalous traffic patterns for the web application. The solution must comply with AWS best practices forinitial response to security incidentsand mustminimize disruptionto the web application.

  Which solution will meet these requirements?

  A. Disable the EC2 instance profile credentials by using AWS Lambda.
  B. Create an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic. Configure the function to remove the affected instance from the Auto Scaling group and attach a restricted security group.
  C. Update the subnet network ACL to block traffic from the detected source IP addresses.
  D. Send GuardDuty findings to Amazon SNS for email notification.
  A. Disable the EC2 instance profile credentials by using AWS Lambda.

  ---

  Explanation

  runs web application fleet EC2 makes Create an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic, Configure the function to remove the affected instance from the the strongest match, because fleet EC2 instances Auto Scaling asks for a managed AWS capability while keeping the service responsibility clear for operations teams. fleet EC2 instances Auto Scaling depends on Create an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic, Configure the function to remove the affected instance from the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. Auto Scaling group EC2 instances is reinforced by A company runs a web application on a fleet of Amazon EC2 instances that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  EC2 instances same VPC subnet also supports Create an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic, Configure the function to remove the affected instance from the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. VPC subnet other workloads deploys would be weaker with Disable the EC2 instance profile credentials by using AWS Lambda,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. workloads deploys GuardDuty detector same separates Update the subnet network ACL to block traffic from the detected source IP addresses, and Send GuardDuty findings to Amazon SNS for email notification, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. detector same Region EC2 instances points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 28:

  A company's application team wants to replace an internal application with a new AWS architecture that consists of Amazon EC2 instances, an AWS Lambda function, and an Amazon S3 bucket in a single AWS Region. After an architecture review, the security team mandates that no application network traffic can traverse the public internet at any point. The security team already has an SCP in place for the company's organization in AWS Organizations to restrict the creation of internet gateways, NAT gateways, and egress-only gateways.

  Which combination of steps should the application team take to meet these requirements? (Select THREE.)

  A. Create an S3 endpoint that has a full-access policy for the application's VPC.
  B. Create an S3 access point for the S3 bucket. Include a policy that restricts the network origin to VPCs.
  C. Launch the Lambda function. Enable the block public access configuration.
  D. Create a security group that has an outbound rule over port 443 with a destination of the S3 endpoint. Associate the security group with the EC2 instances.
  E. Create a security group that has an outbound rule over port 443 with a destination of the S3 access point. Associate the security group with the EC2 instances.
  F. Launch the Lambda function in a VPC.
  A. Create an S3 endpoint that has a full-access policy for the application's VPC.
  B. Create an S3 access point for the S3 bucket. Include a policy that restricts the network origin to VPCs.

  ---

  Explanation

  application team wants replace internal makes Create an S3 endpoint that has a full-access policy for the application's VPC, plus Create an S3 access point for the S3 bucket, Include a policy that restricts the network origin to VPCs, plus Launch the Lambda function in a VPC, the strongest match, because replace internal application new architecture asks for a managed AWS capability which is important when security controls must be repeatable. replace internal application new architecture depends on Create an S3 endpoint that has a full-access policy for the application's VPC, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. new architecture consists EC2 instances is reinforced by A company's application team wants to replace an internal application with a new AWS, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  EC2 instances Lambda function bucket also supports Create an S3 access point for the S3 bucket, Include a policy that restricts the network origin to VPCs,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. function bucket single Region architecture would be weaker with Launch the Lambda function, Enable the block public access configuration,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. Region architecture review team mandates separates Create a security group that has an outbound rule over port 443 with a destination of the S3 endpoint, Associate the security group with the EC2 and Create a security group that has an outbound rule over port 443 with a destination of the S3 access point, Associate the security group with the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. team mandates application network traffic points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 29:

  A company uses SAML federation to grant users access to AWS accounts. A company workload that is in an isolated AWS account runs on immutable infrastructure with no human access to Amazon EC2. The company requires a specialized user known as a break-glass user to have access to the workload AWS account and instances in the case of SAML errors. A recent audit discovered that the company did not create the break-glass user for the AWS account that contains the workload.

  The company must create the break-glass user. The company must log any activities of the break-glass user and send the logs to a security team.

  Which combination of solutions will meet these requirements? (Select TWO.)

  A. Create a local individual break-glass IAM user for the security team. Create a trail in AWS CloudTrail that has Amazon CloudWatch Logs turned on. Use Amazon EventBridge to monitor local user activities.
  B. Create a break-glass EC2 key pair for the AWS account. Provide the key pair to the security team. Use AWS CloudTrail to monitor key pair activity. Send notifications to the security team by using Amazon SNS.
  C. Create a break-glass IAM role for the account. Allow security team members to perform the AssumeRoleWithSAML operation. Create an AWS CloudTrail trail that has Amazon CloudWatch Logs turned on. Use Amazon EventBridge to monitor security team activities.
  D. Create a local individual break-glass IAM user on the operating system level of each workload instance. Configure unrestricted security groups on the instances to grant access to the break-glass IAM users.
  E. Configure AWS Systems Manager Session Manager for Amazon EC2. Configure an AWS CloudTrail filter based on Session Manager. Send the results to an Amazon SNS topic.
  A. Create a local individual break-glass IAM user for the security team. Create a trail in AWS CloudTrail that has Amazon CloudWatch Logs turned on. Use Amazon EventBridge to monitor local user activities.
  B. Create a break-glass EC2 key pair for the AWS account. Provide the key pair to the security team. Use AWS CloudTrail to monitor key pair activity. Send notifications to the security team by using Amazon SNS.

  ---

  Explanation

  SAML federation grant users access makes Create a local individual break-glass IAM user for the security team, Create a trail in AWS CloudTrail that has Amazon CloudWatch Logs turned on, Use Amazon plus Configure AWS Systems Manager Session Manager for Amazon EC2, Configure an AWS CloudTrail filter based on Session Manager, Send the results to an Amazon SNS topic, the strongest match, because users access workload isolated runs asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. users access workload isolated runs depends on Create a local individual break-glass IAM user for the security team, Create a trail in AWS CloudTrail that has Amazon CloudWatch Logs turned on, Use Amazon to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. isolated runs immutable infrastructure human is reinforced by A company uses SAML federation to grant users access to AWS accounts, A company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  infrastructure human access EC2 requires also supports Configure AWS Systems Manager Session Manager for Amazon EC2, Configure an AWS CloudTrail filter based on Session Manager, Send the results to an Amazon SNS topic,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. EC2 requires specialized user known would be weaker with Create a break-glass EC2 key pair for the AWS account, Provide the key pair to the security team, Use AWS CloudTrail to monitor key pair activity,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. user known break glass access separates Create a break-glass IAM role for the account, Allow security team members to perform the AssumeRoleWithSAML operation, Create an AWS

  CloudTrail trail that has Amazon CloudWatch and Create a local individual break-glass IAM user on the operating system level of each workload instance, Configure unrestricted security groups on the instances to grant access from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. glass user access workload instances points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 30:

  A company is attempting to conduct forensic analysis on an Amazon EC2 instance, but the company is unable to connect to the instance by using AWS Systems Manager Session Manager. The company has installed AWS Systems Manager Agent (SSM Agent) on the EC2 instance.

  The EC2 instance is in a subnet in a VPC that does not have an internet gateway attached. The company has associated a security group with the EC2 instance. The security group does not have inbound or outbound rules. The subnet's network ACL allows all inbound and outbound traffic.

  Which combination of actions will allow the company to conduct forensic analysis on the EC2 instance without compromising forensic data? (Select THREE.)

  A. Update the EC2 instance security group to add a rule that allows outbound traffic on port 443 for 0.0.0.0 / 0.
  B. Update the EC2 instance security group to add a rule that allows inbound traffic on port 443 to the VPC ' s CIDR range.
  C. Create an EC2 key pair. Associate the key pair with the EC2 instance.
  D. Create a VPC interface endpoint for Systems Manager in the VPC where the EC2 instance is located.
  E. Attach a security group to the VPC interface endpoint. Allow inbound traffic on port 443 to the VPC ' s CIDR range.
  F. Create a VPC interface endpoint for the EC2 instance in the VPC where the EC2 instance is located.
  A. Update the EC2 instance security group to add a rule that allows outbound traffic on port 443 for 0.0.0.0 / 0.
  B. Update the EC2 instance security group to add a rule that allows inbound traffic on port 443 to the VPC ' s CIDR range.

  ---

  Explanation

  attempting conduct forensic analysis EC2 makes Update the EC2 instance security group to add a rule that allows outbound traffic on port 443 for 0, 0, 0, 0 /0, plus Create a VPC interface endpoint for Systems Manager in the VPC where the EC2 instance is located, plus Attach a security group to the VPC interface endpoint, Allow inbound traffic on port 443 to the VPC ' s CIDR range, the strongest match, because analysis EC2 instance but unable asks for a managed AWS capability and the design remains easier to govern across the environment. analysis EC2 instance but unable depends on Update the EC2 instance security group to add a rule that allows outbound traffic on port 443 for 0, 0, 0, 0 /0, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. but unable connect instance Systems is reinforced by A company is attempting to conduct forensic analysis on an Amazon EC2 instance, but, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  instance Systems Manager Session installed also supports Create a VPC interface endpoint for Systems Manager in the VPC where the EC2 instance is located,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. Session Manager installed

  Systems Agent would be weaker with Update the EC2 instance security group to add a rule that allows inbound traffic on port 443 to the VPC ' s CIDR range,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. Systems Manager Agent SSM EC2 separates Create an EC2 key pair, Associate the key pair with the EC2 instance, and Create a VPC interface endpoint for the EC2 instance in the VPC where the EC2 instance is located, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. SSM Agent EC2 instance subnet points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.