Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 31:

  A company is developing an application that runs across a combination of Amazon EC2 On-Demand Instances and Spot Instances. A security engineer needs to provide a logging solution that makes logs for all instances available from a single location. The solution must allow only a specific set of users to analyze the logs for events patterns. The users must be able to use SQL queries on the logs to perform root cause analysis.

  Which solution will meet these requirements?

  A. Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group. Allow only specific users to access the log group. Use CloudWatch Logs Insights to query the log group.
  B. Configure the EC2 instances to send application logs to a single Amazon S3 bucket. Allow only specific users to access the S3 bucket. Use Amazon CloudWatch Logs Insights to query the log files in the S3 bucket.
  C. Configure each EC2 instance to send its application logs to its own specific Amazon CloudWatch Logslog group. Allow only specific users to access the log groups. Use Amazon Athena to query all the log groups.
  D. Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group. Grant Amazon Detective access to the log group. Allow only specific users to use Detective to query the log group.
  A. Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group. Allow only specific users to access the log group. Use CloudWatch Logs Insights to query the log group.

  ---

  Explanation

  developing application runs combination EC2 makes Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group, Allow only specific users to access the log group, Use the strongest match, because combination EC2 Demand Instances Spot asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. combination EC2 Demand Instances Spot depends on Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group, Allow only specific users to access the log group, Use to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. Instances Spot provide logging makes is reinforced by A company is developing an application that runs across a combination of Amazon EC2, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  provide logging makes logs instances also supports Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group, Allow only specific users to access the log group, Use, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. logs instances available single location would be weaker with Configure the EC2 instances to send application logs to a single Amazon S3 bucket, Allow only specific users to access the S3 bucket, Use Amazon CloudWatch, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. single location allow only specific separates Configure each EC2 instance to send its application logs to its own specific Amazon CloudWatch Logs log group, Allow only specific users to access the log and Configure the EC2 instances to send application logs to a single Amazon CloudWatch Logs log group, Grant Amazon Detective access to the log group, Allow only from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. only specific set users analyze points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 32:

  A company begins to use AWS WAF after experiencing an increase in traffic to the company's public web applications. A security engineer needs to determine if the increase in traffic is because of application-layer attacks. The security engineer needs a solution to analyze AWS WAF traffic.

  Which solution will meet this requirement?

  A. Send AWS WAF logs to AWS CloudTrail and analyze them with OpenSearch.
  B. Send AWS WAF logs to Amazon S3 and query them directly with OpenSearch.
  C. Send AWS WAF logs to Amazon S3. Create an Amazon Athena table with partition projection. Use Athena to query the logs.
  D. Send AWS WAF logs to AWS CloudTrail and analyze them with Amazon Athena.
  A. Send AWS WAF logs to AWS CloudTrail and analyze them with OpenSearch.

  ---

  Explanation

  begins WAF experiencing increase traffic makes Send AWS WAF logs to Amazon S3, Create an Amazon Athena table with partition projection, Use Athena to query the logs, the strongest match, because increase traffic public web applications asks for a managed AWS capability and that reduces the need for extra supervisory automation. increase traffic public web applications depends on Send AWS WAF logs to Amazon

  S3, Create an Amazon Athena table with partition projection, Use Athena to query the logs, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. web applications determine increase traffic is reinforced by A company begins to use AWS WAF after experiencing an increase in traffic to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  increase traffic because application layer also supports Send AWS WAF logs to Amazon S3, Create an Amazon Athena table with partition projection, Use Athena to query the logs,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. application layer attacks analyze WAF would be weaker with Send AWS WAF logs to AWS CloudTrail and analyze them with OpenSearch,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. analyze WAF traffic requirement Send separates Send AWS WAF logs to Amazon S3 and query them directly with OpenSearch, and Send AWS WAF logs to AWS CloudTrail and analyze them with Amazon Athena, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. requirement Send WAF logs Athena points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 33:

  A healthcare company stores more than 1 million patient records in an Amazon S3 bucket. The patient records include personally identifiable information (PII). The S3 bucket contains hundreds of terabytes of data.

  A security engineer receives an alert that was triggered by an Amazon GuardDuty Exfiltration:S3

  /AnomalousBehavior finding. The security engineer confirms that an attacker is using temporary credentials that were obtained from a compromised Amazon EC2 instance that has s3:GetObject permissions for the S3 bucket. The attacker has begun downloading the contents of the bucket. The security engineer contacts a development team. The development team will require 4 hours to implement and deploy a fix.

  The security engineer must take immediate action to prevent the attacker from downloading more data from the S3 bucket.

  Which solution will meet this requirement?

  A. Revoke the temporary session that is associated with the instance profile that is attached to the EC2 instance.
  B. Quarantine the EC2 instance by replacing the existing security group with a new security group that has no rules applied.
  C. Enable Amazon Macie on the S3 bucket. Configure the managed data identifiers for personally identifiable information (PII). Enable S3 Object Lock on objects that Macie flags.
  D. Apply an S3 bucket policy temporarily. Configure the policy to deny read access for all principals to block downloads while the development team address the vulnerability.
  A. Revoke the temporary session that is associated with the instance profile that is attached to the EC2 instance.

  ---

  Explanation

  healthcare stores more than million makes Revoke the temporary session that is associated with the instance profile that is attached to the EC2 instance, the strongest match, because than million patient records bucket asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. than million patient records bucket depends on Revoke the temporary session that is associated with the instance profile that is attached to the EC2 instance, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. records bucket patient include personally is reinforced by A healthcare company stores more than 1 million patient records in an Amazon S3, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  records include personally identifiable information also supports Revoke the temporary session that is associated with the instance profile that is attached to the EC2 instance,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. identifiable information PII bucket contains would be weaker with Quarantine the EC2 instance by replacing the existing security group with a new security group that has no rules applied,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. bucket contains hundreds terabytes data separates Enable Amazon Macie on the S3 bucket, Configure the managed data identifiers for personally identifiable information (PII), Enable S3 Object Lock on objects that Macie flags, and Apply an S3 bucket policy temporarily, Configure the policy to deny read access for all principals to block downloads while the development team address the vulnerability, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. terabytes data receives alert was points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 34:

  A company uses an organization in AWS Organizations to manage its 250 member accounts. The company also uses AWS IAM Identity Center with a SAML external identity provider (IdP). IAM Identity Center has been delegated to a member account. The company ' s security team has access to the delegated account.

  The security team has been investigating a malicious internal user who might be accessing sensitive accounts. The security team needs to know when the user logged into the organization during the last 7 days.

  Which solution will quickly identify the access attempts?

  A. In the delegated account, use Amazon CloudWatch Logs to search for events that match the user details for all successful attempts.
  B. In each member account, use the IAM Identity Center console to search for events that match the user details for all attempts.
  C. In the external IdP, use Amazon EventBridge to search for events that match the user details for all attempts.
  D. In the organization ' s management account, use AWS CloudTrail to search for events that match the user details for all successful attempts.
  A. In the delegated account, use Amazon CloudWatch Logs to search for events that match the user details for all successful attempts.

  ---

  Explanation

  organization Organizations manage 250 member makes In the organization ' s management account, use AWS CloudTrail to search for events that match the user details for all successful attempts, the strongest match, because 250 member also IAM Identity asks for a managed AWS capability while keeping the service responsibility clear for operations teams. 250 member also IAM Identity depends on In the organization ' s management account, use AWS CloudTrail to search for events that match the user details for all successful attempts, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. IAM Identity Center SAML external is reinforced by A company uses an organization in AWS Organizations to manage its 250 member accounts,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  SAML external identity provider IdP also supports In the organization ' s management account, use AWS CloudTrail to search for events that match the user details for all successful attempts,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. provider

  IdP IAM Identity Center would be weaker with In the delegated account, use Amazon CloudWatch Logs to search for events that match the user details for all successful attempts,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. Identity Center been delegated member separates In each member account, use the IAM Identity Center console to search for events that match the user details for all attempts, and In the external IdP, use Amazon EventBridge to search for events that match the user details for all attempts, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. delegated member team access been points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 35:

  A security engineer recently rotated the host keys for an Amazon EC2 instance. The security engineer is trying to access the EC2 instance by using the EC2 Instance Connect feature. However, the security engineer receives an error for failed host key validation. Before the rotation of the host keys, EC2 Instance Connect worked correctly with this EC2 instance.

  What should the security engineer do to resolve this error?

  A. Import the key material into AWS Key Management Service (AWS KMS).
  B. Manually upload the new host key to the AWS trusted host keys database.
  C. Ensure that the AmazonSSMManagedInstanceCore policy is attached to the EC2 instance profile.
  D. Create a new SSH key pair for the EC2 instance.
  A. Import the key material into AWS Key Management Service (AWS KMS).

  ---

  Explanation

  recently rotated host keys EC2 makes Manually upload the new host key to the AWS trusted host keys database, the strongest match, because keys EC2 instance trying access asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. keys EC2 instance trying access depends on Manually upload the new host key to the AWS trusted host keys database, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. trying access EC2 instance Connect is reinforced by A security engineer recently rotated the host keys for an Amazon EC2 instance, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  instance EC2 Connect feature However also supports Manually upload the new host key to the AWS trusted host keys database,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. Connect feature However receives error would be weaker with Import the key material into AWS Key Management Service (AWS KMS),, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. receives error failed host key separates Ensure that the AmazonSSMManagedInstanceCore policy is attached to the EC2 instance profile, and Create a new SSH key pair for the EC2 instance, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. host key validation rotation keys points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 36:

  A security engineer configures a stateless network ACL for a public subnet. Instances in the subnet need to initiate HTTPS connections to trusted external services. The engineer also must block inbound database connections to the subnet.

  A. Allow inbound TCP 443 only and deny outbound ephemeral ports.
  B. Allow outbound database port traffic and rely on security groups to permit HTTPS responses.
  C. Deny all inbound ephemeral ports and allow only inbound database port traffic from the internet.
  D. Allow outbound TCP 443, allow inbound ephemeral response ports, and deny inbound database port traffic with a lower rule number than any broad allow.
  A. Allow inbound TCP 443 only and deny outbound ephemeral ports.

  ---

  Explanation

  configures stateless network ACL public makes Allow outbound TCP 443, allow inbound ephemeral response ports, and deny inbound database port traffic with a lower rule number than any broad allow, the strongest match, because ACL public subnet Instances need asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. ACL public subnet Instances need depends on Allow outbound TCP 443, allow inbound ephemeral response ports, and deny inbound database port traffic with a lower rule number than any broad allow, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. Instances subnet need initiate HTTPS is reinforced by A security engineer configures a stateless network ACL for a public subnet, Instances in, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  initiate HTTPS connections trusted external also supports Allow outbound TCP 443, allow inbound ephemeral response ports, and deny inbound database port traffic with a lower rule number than any broad allow,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. trusted external also block inbound would be weaker with Allow inbound TCP 443 only and deny outbound ephemeral ports,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. block inbound database connections subnet separates Allow outbound database port traffic and rely on security groups to permit HTTPS responses, and Deny all inbound ephemeral ports and allow only inbound database port traffic from the internet, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. connections subnet Allow outbound TCP points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 37:

  A company runs an internet-accessible application on several Amazon EC2 instances that run Windows Server. The company used an instance profile to configure the EC2 instances. A security team currently accesses the VPC that hosts the EC2 instances by using an AWS Site-to-Site VPN tunnel from an on-premises office. The security team issues a policy that requires all external access to the VPC to be blocked in the event of a security incident. However, during an incident, the security team must be able to access the EC2 instances to obtain forensic information on the instances.

  Which solution will meet these requirements?

  A. Install EC2 Instance Connect on the EC2 instances. Update the IAM policy for the IAM role to grant the required permissions. Use the AWS CLI to open a tunnel to connect to the instances.
  B. Install EC2 Instance Connect on the EC2 instances. Configure the instances to permit access to the ec2- instance-connect command user. Use the AWS Management Console to connect to the EC2 instances.
  C. Create an EC2 Instance Connect endpoint in the VPC. Configure an appropriate security group to allow access between the EC2 instances and the endpoint. Use the AWS CLI to open a tunnel to connect to the instances.
  D. Create an EC2 Instance Connect endpoint in the VPC. Configure an appropriate security group to allow access between the EC2 instances and the endpoint. Use the AWS Management Console to connect to the EC2 instances.
  A. Install EC2 Instance Connect on the EC2 instances. Update the IAM policy for the IAM role to grant the required permissions. Use the AWS CLI to open a tunnel to connect to the instances.

  ---

  Explanation

  runs internet accessible application several makes Create an EC2 Instance Connect endpoint in the VPC, Configure an appropriate security group to allow access between the EC2 instances and the endpoint, Use the the strongest match, because application several EC2 instances run asks for a managed AWS capability while keeping the service responsibility clear for operations teams. application several EC2 instances run depends on Create an EC2 Instance Connect endpoint in the VPC, Configure an appropriate security group to allow access between the EC2 instances and the endpoint, Use the to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. instances run Windows Server used is reinforced by A company runs an internet-accessible application on several Amazon EC2 instances that run Windows, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  Server used instance profile EC2 also supports Create an EC2 Instance Connect endpoint in the VPC, Configure an appropriate security group to allow access between the EC2 instances and the endpoint, Use the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. profile EC2 instances team currently would be weaker with Install EC2 Instance Connect on the EC2 instances, Update the IAM policy for the IAM role to grant the required permissions, Use the AWS CLI to, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. team currently accesses VPC hosts separates Install EC2 Instance Connect on the EC2 instances, Configure the instances to permit access to the ec2-instance-connect command user, Use the AWS Management Console to connect and Create an EC2 Instance Connect endpoint in the VPC, Configure an appropriate security group to allow access between the EC2 instances and the endpoint, Use the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. VPC hosts EC2 instances Site points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 38:

  A company has installed a third-party application that is distributed on several Amazon EC2 instances and on-premises servers. Occasionally, the company ' s IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection.

  Which solution will meet these requirements?

  A. Create a bastion host with port forwarding to connect to the machines.
  B. Set up AWS Systems Manager Session Manager to allow temporary connections.
  C. Use AWS CloudShell to create serverless connections.
  D. Set up an interface VPC endpoint for each machine for private connection.
  A. Create a bastion host with port forwarding to connect to the machines.

  ---

  Explanation

  installed third party application distributed makes Set up AWS Systems Manager Session Manager to allow temporary connections, the strongest match, because application distributed several EC2 instances asks for a managed AWS capability and that reduces the need for extra supervisory automation. application distributed several EC2 instances depends on Set up AWS Systems Manager Session Manager to allow temporary connections, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. EC2 instances premises servers Occasionally is reinforced by A company has installed a third-party application that is distributed on several Amazon EC2, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  servers Occasionally team SSH connect also supports Set up AWS Systems Manager Session Manager to allow temporary connections,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. SSH connect machine perform software would be weaker with Create a bastion host with port forwarding to connect to the machines,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. perform software maintenance tasks Outside separates Use AWS CloudShell to create serverless connections, and Set up an interface VPC endpoint for each machine for private connection, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. tasks Outside time slots machines points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 39:

  A company needs to build a code-signing solution using an AWS KMS asymmetric key and must store immutable evidence of key creation and usage for compliance and audit purposes.

  Which solution meets these requirements?

  A. Create an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrail trail with log file validation enabled for KMS events. Store logs in the bucket and grant auditors access.
  B. Log application events to Amazon CloudWatch Logs and export them.
  C. Capture KMS API calls using EventBridge and store them in DynamoDB.
  D. Track KMS usage with CloudWatch metrics and dashboards.
  A. Create an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrail trail with log file validation enabled for KMS events. Store logs in the bucket and grant auditors access.

  ---

  Explanation

  build code signing KMS asymmetric makes Create an Amazon S3 bucket with S3 Object Lock enabled, Create an AWS CloudTrail trail with log file validation enabled for KMS events, Store logs in the strongest match, because KMS asymmetric key store immutable asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. KMS asymmetric key store immutable depends on Create an Amazon S3 bucket with S3 Object Lock enabled, Create an AWS CloudTrail trail with log file validation enabled for KMS events, Store logs in to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. store immutable evidence key creation is reinforced by A company needs to build a code-signing solution using an AWS KMS asymmetric key, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  key creation usage compliance audit also supports Create an Amazon S3 bucket with S3 Object Lock enabled, Create an AWS CloudTrail trail with log file validation enabled for KMS events, Store logs in, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. compliance audit purposes requirements bucket would be weaker with Log application events to Amazon CloudWatch Logs and export them,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. requirements bucket Object Lock enabled separates Capture KMS API calls using EventBridge and store them in DynamoDB, and Track KMS usage with CloudWatch metrics and dashboards, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Lock enabled CloudTrail trail log points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 40:

  A consultant agency needs to perform a security audit for a company ' s production AWS account. Several consultants need access to the account. The consultant agency already has its own AWS account. The company requires multi-factor authentication (MFA) for all access to its production account. The company also forbids the use of long-term credentials.

  Which solution will provide the consultant agency with access that meets these requirements?

  A. Create an IAM group. Create an IAM user for each consultant. Add each user to the group. Turn on MFA for each consultant.
  B. Configure Amazon Cognito on the company's production account to authenticate against the consultant agency ' s identity provider (IdP). Add MFA to a Cognito user pool.
  C. Create an IAM role in the consultant agency ' s AWS account. Define a trust policy that requires MFA. Inthe trust policy, specify the company ' s production account as the principal. Attach the trust policy to the role.
  D. Create an IAM role in the company's production account. Define a trust policy that requires MFA. In the trust policy, specify the consultant agency ' s AWS account as the principal. Attach the trust policy to the role.
  A. Create an IAM group. Create an IAM user for each consultant. Add each user to the group. Turn on MFA for each consultant.

  ---

  Explanation

  consultant agency perform audit production makes Create an IAM role in the company's production account, Define a trust policy that requires MFA, In the trust policy, specify the consultant agency ' s the strongest match, because audit production Several consultants need asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. audit production Several consultants need depends on Create an IAM role in the company's production account, Define a trust policy that requires MFA, In the trust policy, specify the consultant agency ' s to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. consultants need access consultant agency is reinforced by A consultant agency needs to perform a security audit for a company ' s, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  consultant agency already own requires also supports Create an IAM role in the company's production account, Define a trust policy that requires MFA, In the trust policy, specify the consultant agency ' s, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. own requires multi factor authentication would be weaker with Create an IAM group, Create an IAM user for each consultant, Add each user to the group, Turn on MFA for each consultant,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. factor authentication MFA access production separates Configure Amazon Cognito on the company's production account to authenticate against the consultant agency ' s identity provider (IdP), Add MFA to a Cognito user pool, and Create an IAM role in the consultant agency ' s AWS account, Define a trust policy that requires MFA, In the trust policy, specify the company from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. access production also forbids long points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.