Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 41:

  A security engineer needs to control access to data that is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The security engineer also needs to use additional authenticated data (AAD) to prevent tampering with ciphertext.

  Which solution will meet these requirements?

  A. Pass the key alias to AWS KMS when calling the Encrypt and Decrypt API actions.
  B. Use IAM policies to restrict access to the Encrypt and Decrypt API actions.
  C. Use the kms:EncryptionContext condition key when defining IAM policies for the customer managed key.
  D. Use key policies to restrict access to the appropriate IAM groups.
  A. Pass the key alias to AWS KMS when calling the Encrypt and Decrypt API actions.

  ---

  Explanation

  control access data encrypted Key makes Use the kms, EncryptionContext condition key when defining IAM policies for the customer managed key, the strongest match, because encrypted Key Management KMS customer asks for a managed AWS capability while keeping the service responsibility clear for operations teams. encrypted Key Management KMS customer depends on Use the kms, EncryptionContext condition key when defining IAM policies for the customer managed key, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. KMS customer managed key also is reinforced by A security engineer needs to control access to data that is encrypted with an, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  key also additional authenticated data also supports Use the kms, EncryptionContext condition key when defining IAM policies for the customer managed key,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. authenticated data AAD prevent tampering would be weaker with Pass the key alias to AWS KMS when calling the Encrypt and Decrypt API actions,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. prevent tampering ciphertext requirements kms separates Use IAM policies to restrict access to the Encrypt and Decrypt API actions, and Use key policies to restrict access to the appropriate IAM groups, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. requirements kms EncryptionContext condition key points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 42:

  A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company wants to centrally give users the ability to access Amazon Q Developer.

  Which solution will meet this requirement?

  A. Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application.
  B. Enable Amazon Cognito and create a new identity pool for Amazon Q Developer.
  C. Enable Amazon Cognito and set up Amazon Q Developer as an AWS managed application.
  D. Enable AWS IAM Identity Center and create a new identity pool for Amazon Q Developer.
  A. Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application.

  ---

  Explanation

  organization Organizations manage multiple wants makes Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application, the strongest match, because multiple wants centrally give users asks for a managed AWS capability and the design remains easier to govern across the environment. multiple wants centrally give users depends on Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. give users ability access Developer is reinforced by A company uses an organization in AWS Organizations to manage multiple AWS accounts, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  access Developer requirement Enable IAM also supports Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. Enable IAM Identity Center set would be weaker with Enable Amazon Cognito and create a new identity pool for Amazon Q Developer,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. Center set Developer managed application separates Enable Amazon Cognito and set up Amazon Q Developer as an AWS

  managed application, and Enable AWS IAM Identity Center and create a new identity pool for Amazon Q Developer, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. managed application Enable Cognito new points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 43:

  A company needs to securely deploy resources and workloads across AWS accounts. The accounts are in an organization in AWS Organizations. The company needs to use AWS CloudFormation for infrastructure as code (IaC) management of approved architectural patterns. The company also must enforce tagging requirements and specific guidelines for resource and workload configuration and creation.

  Which solution will meet these requirements?

  A. Use CloudFormation stack policies to prevent the creation of resources that do not meet the tagging or configuration requirements. Use Amazon EventBridge rules to detect API calls that attempt to create resources outside of CloudFormation.
  B. Use an AWS CodePipeline pipeline to test and deploy IaC-defined workloads through CloudFormation into the accounts. Use AWS Config rules to enforce the tagging requirements. Apply an SCP to prevent the creation of misconfigured resources in all OUs.
  C. Create an IAM permissions boundary to prevent the creation of misconfigured resources through CloudFormation and to enforce the tagging requirements. Apply the permissions boundary to all account roles. Use AWS Config rules to identify existing resources that are in a misconfigured state.
  D. Use AWS Service Catalog with CloudFormation to manage access to approved architecture configurations. Provision Service Catalog portfolios to the accounts across the organization. Use AWS Config rules to enforce the tagging requirements and other resource configuration policies across accounts.
  A. Use CloudFormation stack policies to prevent the creation of resources that do not meet the tagging or configuration requirements. Use Amazon EventBridge rules to detect API calls that attempt to create resources outside of CloudFormation.

  ---

  Explanation

  securely deploy resources workloads organization makes Use AWS Service Catalog with CloudFormation to manage access to approved architecture configurations, Provision Service Catalog portfolios to the accounts across the organization, Use AWS Config the strongest match, because workloads organization Organizations CloudFormation infrastructure asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. workloads organization Organizations CloudFormation infrastructure depends on Use AWS Service Catalog with CloudFormation to manage access to approved architecture configurations, Provision Service Catalog portfolios to the accounts across the organization, Use AWS Config to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. CloudFormation infrastructure code IaC management is reinforced by A company needs to securely deploy resources and workloads across AWS accounts, The accounts, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  IaC management approved architectural patterns also supports Use AWS Service Catalog with CloudFormation to manage access to approved architecture configurations, Provision Service Catalog portfolios to the accounts across the organization, Use AWS Config, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. architectural patterns also enforce tagging would be weaker with Use CloudFormation stack policies to prevent the creation of resources that do not meet the tagging or configuration requirements, Use Amazon EventBridge rules to detect API, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. enforce tagging requirements specific guidelines separates Use an AWS CodePipeline pipeline to test and deploy IaC-defined workloads through CloudFormation into the accounts, Use AWS Config rules to enforce the tagging requirements, Apply and Create an IAM permissions boundary to prevent the creation of misconfigured resources through CloudFormation and to enforce the tagging requirements, Apply the permissions boundary to all from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. specific guidelines resource workload configuration points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 44:

  A company needs the ability to identify the root cause of security findings in an AWS account. The company has enabled VPC Flow Logs, Amazon GuardDuty, and AWS CloudTrail. The company must investigate any IAM roles that are involved in the security findings and must visualize the findings.

  Which solution will meet these requirements?

  A. Use Amazon Detective to run investigations on the IAM roles and to visualize the findings.
  B. Use Amazon Inspector to run investigations on the IAM roles and visualize the findings.
  C. Export GuardDuty findings to Amazon S3 and analyze them with Amazon Athena.
  D. Enable AWS Security Hub and use custom actions to investigate IAM roles.
  A. Use Amazon Detective to run investigations on the IAM roles and to visualize the findings.

  ---

  Explanation

  ability identify root cause findings makes Use Amazon Detective to run investigations on the IAM roles and to visualize the findings, the strongest match, because cause findings enabled VPC Flow asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. cause findings enabled VPC Flow depends on Use Amazon Detective to run investigations on the IAM roles and to visualize the findings, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. VPC Flow Logs GuardDuty CloudTrail is reinforced by A company needs the ability to identify the root cause of security findings in, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  GuardDuty CloudTrail investigate any IAM also supports Use Amazon Detective to run investigations on the IAM roles and to visualize the findings,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. any IAM roles involved findings would be weaker with Use Amazon Inspector to run investigations on the IAM roles and visualize the findings,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. involved findings visualize requirements Detective separates Export GuardDuty findings to Amazon S3 and analyze them with Amazon Athena, and Enable AWS Security Hub and use custom actions to investigate IAM roles, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. findings requirements Detective run investigations points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 45:

  A company has an organization in AWS Organizations. The company uses AWS IAM Identity Center and an external identity provider to manage access. The company needs a solution that maintains access to AWS if the identity provider has an outage. The solution must be able to attribute any emergency access to an individual administrator.

  Which solution will meet these requirements?

  A. Create IAM users for emergency administrators. Set strong passwords and MFA for the IAM users. Assign permissions that grant the IAM users cross-account access to accounts within the organization to perform emergency change actions.
  B. Create emergency users within the identity provider. Enable System for Cross-domain Identity Management provisioning to help ensure mapping between IAM Identity Center and the identity provider. Assign permission sets in IAM Identity Center to the emergency users to give the users cross-account access to perform emergency change actions.
  C. Configure a secondary identity provider in IAM Identity Center. Create emergency users in the secondary identity provider that have permissions to perform cross-account emergency change actions. Change the IAM Identity Center external identity provider to the secondary identity provider.
  D. Create access keys for the management account's root user. Store the access keys in a shared secret vault for use by any emergency administrator. Use the access keys to perform emergency change actions across the organization.
  A. Create IAM users for emergency administrators. Set strong passwords and MFA for the IAM users. Assign permissions that grant the IAM users cross-account access to accounts within the organization to perform emergency change actions.

  ---

  Explanation

  organization Organizations IAM Identity Center makes Create IAM users for emergency administrators, Set strong passwords and MFA for the IAM users, Assign permissions that grant the IAM users cross-account access to accounts the strongest match, because Identity Center external provider manage asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. Identity Center external provider manage depends on Create IAM users for emergency administrators, Set strong passwords and MFA for the IAM users, Assign permissions that grant the IAM users cross-account access to accounts to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. identity provider manage access maintains is reinforced by A company has an organization in AWS Organizations, The company uses AWS IAM Identity, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  access maintains identity provider outage also supports Create IAM users for emergency administrators, Set strong passwords and MFA for the IAM users, Assign permissions that grant the IAM users cross-account access to accounts, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. identity provider outage able attribute would be weaker with Create emergency users within the identity provider, Enable System for Cross-domain Identity Management provisioning to help ensure mapping between IAM Identity Center and the identity provider,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. able attribute any emergency access separates Configure a secondary identity provider in IAM Identity Center, Create emergency users in the secondary identity provider that have permissions to perform cross-account emergency change actions, and Create access keys for the management account's root user, Store the access keys in a shared secret vault for use by any emergency administrator, Use the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. emergency access individual administrator requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 46:

  A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running in Amazon Elastic Container Service (Amazon ECS). This solution must also handle volatile traffic patterns.

  Which solution would have the MOST scalability and LOWEST latency?

  A. Configure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
  B. Configure an Application Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
  C. Configure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers.
  D. Configure Amazon Route 53 to use multivalue answer routing to send traffic to the containers.
  A. Configure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.

  ---

  Explanation

  designing provide end encryption between makes Configure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers, the strongest match, because end encryption between clients Docker asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. end encryption between clients Docker depends on Configure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. clients Docker containers running Elastic is reinforced by A security engineer is designing a solution that will provide end-to-end encryption between clients, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  running Elastic Container ECS also also supports Configure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. ECS also handle volatile traffic would be weaker with Configure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. volatile traffic patterns would scalability separates Configure an Application Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers, and Configure Amazon Route 53 to use multivalue answer routing to send traffic to the containers, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. would scalability LOWEST latency Network points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 47:

  A company is running an application on Amazon EC2 instances in an Auto Scaling group. The application stores logs locally. A security engineer noticed that logs were lost after a scale-in event. The security engineer needs to recommend a solution to ensure the durability and availability of log data. All logs must be kept for a minimum of 1 year for auditing purposes.

  What should the security engineer recommend?

  A. Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review.
  B. Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation. Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system.
  C. Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review.
  D. Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon Simple Notification Service (Amazon SNS). Configure the hook to remain in the Terminating:Wait state for 1 hour to allow manual review of the security logs prior to instance termination.
  A. Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review.

  ---

  Explanation

  running application EC2 instances Auto makes Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group, Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs the strongest match, because instances Auto Scaling group application asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. instances Auto Scaling group application depends on Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group, Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. group application stores logs locally is reinforced by A company is running an application on Amazon EC2 instances in an Auto Scaling, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  logs locally noticed were lost also supports Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group, Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. logs were lost scale event would be weaker with Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. scale event recommend ensure durability separates Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to and Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. ensure durability availability log data points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 48:

  A company runs a public web application on Amazon EKS behind Amazon CloudFront and an Application Load Balancer (ALB). A security engineer must send a notification to an existing Amazon SNS topic when the application receives 10,000 requests from the same end-user IP address within any 5-minute period.

  Which solution will meet these requirements?

  A. Configure CloudFront standard logging and CloudWatch Logs metric filters.
  B. Configure VPC Flow Logs and CloudWatch Logs metric filters.
  C. Configure an AWS WAF web ACL with an ASN match rule and CloudWatch alarms.
  D. Configure an AWS WAF web ACL with a rate-based rule. Associate it with CloudFront. Create a CloudWatch alarm to notify SNS.
  A. Configure CloudFront standard logging and CloudWatch Logs metric filters.

  ---

  Explanation

  runs public web application EKS makes Configure an AWS WAF web ACL with a rate-based rule, Associate it with CloudFront, Create a CloudWatch alarm to notify SNS, the strongest match, because application EKS behind CloudFront Load asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. application EKS behind CloudFront Load depends on Configure an AWS WAF web ACL with a rate-based rule, Associate it with CloudFront, Create a CloudWatch alarm to notify SNS, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. CloudFront Application Load Balancer ALB is reinforced by A company runs a public web application on Amazon EKS behind Amazon CloudFront and, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  Balancer ALB send notification SNS also supports Configure an AWS WAF web ACL with a rate-based rule, Associate it with CloudFront, Create a CloudWatch alarm to notify SNS,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. notification SNS topic application receives would be weaker with Configure CloudFront standard logging and CloudWatch Logs metric filters,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. application receives 000 requests same separates Configure VPC Flow Logs and CloudWatch Logs metric filters, and Configure an AWS WAF web ACL with an ASN match rule and CloudWatch alarms, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. requests same end user address points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 49:

  A company's data scientists use Amazon SageMaker with datasets stored in Amazon S3. Data older than 45 days must be removed according to policy.

  Which action should enforce this policy?

  A. Configure an S3 Lifecycle rule to delete objects after 45 days.
  B. Create a Lambda function triggered on object upload to delete old data.
  C. Create a scheduled Lambda function to delete old objects monthly.
  D. Configure S3 Intelligent-Tiering.
  A. Configure an S3 Lifecycle rule to delete objects after 45 days.

  ---

  Explanation

  data scientists SageMaker datasets stored makes Configure an S3 Lifecycle rule to delete objects after 45 days, the strongest match, because datasets stored Data older than asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. datasets stored Data older than depends on Configure an S3 Lifecycle rule to delete objects after 45 days, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. older than days removed according is reinforced by A company's data scientists use Amazon SageMaker with datasets stored in Amazon S3, Data, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  removed according policy action should also supports Configure an S3 Lifecycle rule to delete objects after 45 days,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable.

  action should enforce policy Lifecycle would be weaker with Create a Lambda function triggered on object upload to delete old data,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. policy Lifecycle rule delete objects separates Create a scheduled Lambda function to delete old objects monthly, and Configure S3 Intelligent-Tiering, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. delete objects days Lambda function points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 50:

  A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store ' s application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account.

  The company uses AWS Organizations and has an OU that is used only for these accounts.

  The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company ' s deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access.

  The security engineer already has created an AWS CloudFormation template that implements the deployment plan.

  What should the security engineer do next to meet the requirements in theMOST secureway?

  A. Create an AWS Service Catalog portfolio in the organization ' s management account. Upload the CloudFormation template. Add the template to the portfolio ' s product list. Share the portfolio with the OU.
  B. Use the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. In the OU, create an SCP that allows access to the extension.
  C. Create an AWS Service Catalog portfolio in the organization ' s management account. Upload the CloudFormation template. Add the template to the portfolio ' s product list. Create an IAM role that has a trust policy that allows cross-account access to the portfolio for users in the OU accounts. Attach the AWSServiceCatalogEndUserFullAccess managed policy to the role.
  D. Use the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. Share the extension with the OU.
  A. Create an AWS Service Catalog portfolio in the organization ' s management account. Upload the CloudFormation template. Add the template to the portfolio ' s product list. Share the portfolio with the OU.

  ---

  Explanation

  expanding group stores day new makes Create an AWS Service Catalog portfolio in the organization ' s management account, Upload the CloudFormation template, Add the template to the portfolio ' s product the strongest match, because day new store opens wants asks for a managed AWS capability which is important when security controls must be repeatable. day new store opens wants depends on Create an AWS Service Catalog portfolio in the organization ' s management account, Upload the CloudFormation template, Add the template to the portfolio ' s product to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. opens wants launch customized web is reinforced by A company is expanding its group of stores, On the day that each new, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  customized web application store non also supports Create an AWS Service Catalog portfolio in the organization ' s management account, Upload the CloudFormation template, Add the template to the portfolio ' s product, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. store application non production environment would be weaker with Use the CloudFormation CLI to create a module from the CloudFormation template, Register the module as a private extension in the CloudFormation registry, Publish the extension,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. non production environment deployed separate separates Create an AWS Service Catalog portfolio in the organization ' s management account, Upload the CloudFormation template, Add the template to the portfolio ' s product and Use the CloudFormation CLI to create a module from the CloudFormation template, Register the module as a private extension in the CloudFormation registry, Publish the extension, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. production environment deployed separate Organizations points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.