Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 61:

  A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region that uses an AWS KMS customer managed key. The company must copy a DB snapshot to the us-west-1 Region but cannot access the encryption key across Regions.

  What should the company do to properly encrypt the snapshot in us-west-1?

  A. Store the customer managed key in AWS Secrets Manager in us-west-1.
  B. Create a new customer managed key in us-west-1 and use it to encrypt the snapshot.
  C. Create an IAM policy to allow access to the key in us-east-1 from us-west-1.
  D. Create an IAM policy that allows RDS in us-west-1 to access the key in us-east-1.
  A. Store the customer managed key in AWS Secrets Manager in us-west-1.

  ---

  Explanation

  encrypted Aurora cluster east Region makes Create a new customer managed key in us-west-1 and use it to encrypt the snapshot, the strongest match, because east Region KMS customer managed asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. east Region KMS customer managed depends on Create a new customer managed key in us-west-1 and use it to encrypt the snapshot, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. customer managed key copy snapshot is reinforced by A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  copy snapshot west Region but also supports Create a new customer managed key in us-west-1 and use it to encrypt the snapshot,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. Region but cannot access encryption would be weaker with Store the customer managed key in AWS Secrets Manager in us-west-1,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. access encryption key Regions.

  What separates Create an IAM policy to allow access to the key in us-east-1 from us-west-1, and Create an IAM policy that allows RDS in us-west-1 to access the key in us-east-1, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Regions.

  What should properly encrypt points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 62:

  A security engineer is reducing excessive IAM permissions. The engineer needs to identify services and actions that IAM principals have used recently so unused permissions can be removed with minimal guesswork.

  A. Use Amazon Macie to classify IAM policy documents as sensitive data.
  B. Use AWS Artifact to identify which principals have administrator access.
  C. Use VPC Flow Logs to determine every IAM action performed by each role.
  D. Use IAM Access Analyzer last accessed information to review permissions that have been used.
  A. Use Amazon Macie to classify IAM policy documents as sensitive data.

  ---

  Explanation

  reducing excessive IAM permissions identify makes Use IAM Access Analyzer last accessed information to review permissions that have been used, the strongest match, because permissions identify actions IAM principals asks for a managed AWS capability which is important when security controls must be repeatable. permissions identify actions IAM principals depends on Use IAM Access Analyzer last accessed information to review permissions that have been used, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. IAM principals used recently unused is reinforced by A security engineer is reducing excessive IAM permissions, The engineer needs to identify services, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  recently unused permissions removed minimal also supports Use IAM Access Analyzer last accessed information to review permissions that have been used,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. removed minimal guesswork IAM Access would be weaker with Use Amazon Macie to classify IAM policy documents as sensitive data,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. IAM Access Analyzer last accessed separates Use AWS Artifact to identify which principals have administrator access, and Use VPC Flow Logs to determine every IAM action performed by each role, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. last accessed information review permissions points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 63:

  A company requires every new cloud resource to include a CostCenter tag with one of several approved values. The company also wants to prevent users from creating resources when the required tag is missing.

  Which combination of controls should the company use? Choose two.

  A. Use AWS Organizations tag policies to define approved tag keys and values.
  B. Use an SCP that denies supported create actions when the required request tag is missing.
  C. Use VPC Flow Logs to detect untagged resource creation.
  D. Use AWS Artifact to publish the list of approved tag values.
  E. Use Amazon Macie to apply missing tags automatically.
  A. Use AWS Organizations tag policies to define approved tag keys and values.
  B. Use an SCP that denies supported create actions when the required request tag is missing.

  ---

  Explanation

  requires every new cloud resource makes Use AWS Organizations tag policies to define approved tag keys and values, plus Use an SCP that denies supported create actions when the required request tag is missing, the strongest match, because cloud resource include CostCenter tag asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. cloud resource include CostCenter tag depends on Use AWS Organizations tag policies to define approved tag keys and values, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. CostCenter tag several approved values is reinforced by A company requires every new cloud resource to include a CostCenter tag with one, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  approved values also wants prevent also supports Use an SCP that denies supported create actions when the required request tag is missing,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. wants prevent users creating resources would be weaker with Use VPC Flow Logs to detect untagged resource creation,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. creating resources required tag missing separates Use AWS Artifact to publish the list of approved tag values, and Use Amazon Macie to apply missing tags automatically, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. tag missing combination controls should points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 64:

  A company runs its microservices architecture in Kubernetes containers on AWS by using Amazon Elastic Kubernetes Service (Amazon EKS) and Amazon Aurora. The company has an organization in AWS Organizations to manage hundreds of AWS accounts that host different microservices.

  The company needs to implement a monitoring solution for logs from all AWS resources across all accounts.

  The solution must include automatic detection of security-related issues.

  Which solution will meet these requirements with theLEAST operational effort?

  A. Designate an Amazon GuardDuty administrator account in the organization's management account. Enable GuardDuty for all accounts. Enable EKS Protection and RDS Protection in the GuardDuty administrator account.
  B. Designate a monitoring account. Share Amazon CloudWatch Logs from all accounts. Use Amazon Inspector to evaluate the logs.
  C. Centralize CloudTrail logs in Amazon S3 and analyze them with Amazon Athena.
  D. Stream CloudWatch Logs to Amazon Kinesis and analyze them with custom AWS Lambda functions.
  A. Designate an Amazon GuardDuty administrator account in the organization's management account. Enable GuardDuty for all accounts. Enable EKS Protection and RDS Protection in the GuardDuty administrator account.

  ---

  Explanation

  runs microservices architecture Kubernetes containers makes Designate an Amazon GuardDuty administrator account in the organization's management account, Enable GuardDuty for all accounts, Enable EKS Protection and RDS Protection in the GuardDuty administrator the strongest match, because Kubernetes containers Elastic EKS Aurora asks for a managed AWS capability and that reduces the need for extra supervisory automation. Kubernetes containers Elastic EKS Aurora depends on Designate an Amazon GuardDuty administrator account in the organization's management account, Enable GuardDuty for all accounts, Enable EKS Protection and RDS Protection in the GuardDuty administrator to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. Kubernetes EKS Aurora organization Organizations is reinforced by A company runs its microservices architecture in Kubernetes containers on AWS by using Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  organization Organizations manage hundreds host also supports Designate an Amazon GuardDuty administrator account in the organization's management account, Enable GuardDuty for all accounts, Enable EKS Protection and RDS Protection in the GuardDuty administrator, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. hundreds host different microservices implement would be weaker with Designate a monitoring account, Share Amazon CloudWatch Logs from all accounts, Use Amazon Inspector to evaluate the logs,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. microservices implement monitoring logs resources separates Centralize CloudTrail logs in Amazon S3 and analyze them with Amazon Athena, and Stream CloudWatch Logs to Amazon Kinesis and analyze them with custom AWS Lambda functions, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. logs resources include automatic detection points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 65:

  A company manages multiple AWS accounts through an organization in AWS Organizations. The company enables all features in the organization.

  A security team must implement a solution to centrally manage VPC security groups across the accounts.

  The company uses an existing reference security group with the required configuration. The solution must detect if security group rules have been modified to deviate from the reference security group. The solution must automatically restore any noncompliant security groups to match the reference security group.

  The security team needs to select a solution that does not require custom development or scripting.

  Which solution will meet these requirements?

  A. Use AWS Firewall Manager to manage security group rules through security group policy rules.
  B. Create an AWS Systems Manager Automation runbook to identify and align noncompliant security groups with the reference security group.
  C. Use a custom AWS Config rule with auto remediation. Compare to the reference security group for compliance.
  D. Manage security groups through AWS CloudFormation StackSets. Use the reference security group for the initial rules.
  A. Use AWS Firewall Manager to manage security group rules through security group policy rules.

  ---

  Explanation

  manages multiple through organization Organizations makes Use AWS Firewall Manager to manage security group rules through security group policy rules, the strongest match, because organization Organizations enables features team asks for a managed AWS capability and the design remains easier to govern across the environment. organization Organizations enables features team depends on Use AWS Firewall Manager to manage security group rules through security group policy rules, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. features organization team implement centrally is reinforced by A company manages multiple AWS accounts through an organization in AWS Organizations, The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  implement centrally manage VPC groups also supports Use AWS Firewall Manager to manage security group rules through security group policy rules,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. VPC groups reference group required would be weaker with Create an AWS Systems Manager Automation runbook to identify and align noncompliant security groups with the reference security group,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. group required configuration detect rules separates Use a custom AWS Config rule with auto remediation, Compare to the reference security group for compliance, and Manage security groups through AWS CloudFormation StackSets, Use the reference security group for the initial rules, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. detect group rules been modified points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 66:

  An IAM user receives an Access Denied message when the user attempts to access objects in an Amazon

  S3 bucket. The user and the S3 bucket are in the same AWS account. The S3 bucket is configured to use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt all of its objects at rest by using a customer managed key from the same AWS account. The S3 bucket has no bucket policy defined. The IAM user has been granted permissions through an IAM policy that allows thekms:Decryptpermission to the customer managed key. The IAM policy also allows thes3:List* ands3:Get* permissions for the S3 bucket

  and its objects.

  Which of the following is a possible reason that the IAM user cannot access the objects in the S3 bucket?

  A. The IAM policy needs to allow thekms:DescribeKeypermission.
  B. The S3 bucket has been changed to use the AWS managed key to encrypt objects at rest.
  C. An S3 bucket policy needs to be added to allow the IAM user to access the objects.
  D. The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.
  A. The IAM policy needs to allow thekms:DescribeKeypermission.

  ---

  Explanation

  IAM user receives Access Denied makes.

  The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key, the strongest match, because Access Denied message user attempts asks for a managed AWS capability while keeping the service responsibility clear for operations teams. Access Denied message user attempts depends on The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. user attempts access objects bucket is reinforced by An IAM user receives an Access Denied message when the user attempts to access, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  objects bucket user same configured also supports The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. bucket same configured server side would be weaker with The IAM policy needs to allow thekms, DescribeKeypermission,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. configured server side encryption KMS separates.

  The S3 bucket has been changed to use the AWS managed key to encrypt objects at rest, and An S3 bucket policy needs to be added to allow the IAM user to access the objects, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. encryption KMS keys SSE encrypt points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 67:

  A company is using Amazon Macie, AWS Firewall Manager, Amazon Inspector, and AWS Shield Advanced in its AWS account. The company wants to receive alerts if a DDoS attack occurs against the account.

  Which solution will meet this requirement?

  A. Use Amazon Macie to detect an active DDoS event and create Amazon CloudWatch alarms that respond to Macie findings.
  B. Use Amazon Inspector to review resources and invoke Amazon CloudWatch alarms for any resources that are vulnerable to DDoS attacks.
  C. Create an Amazon CloudWatch alarm that monitors AWS Firewall Manager metrics for an active DDoS event.
  D. Create an Amazon CloudWatch alarm that monitors AWS Shield Advanced metrics for an active DDoS event.
  A. Use Amazon Macie to detect an active DDoS event and create Amazon CloudWatch alarms that respond to Macie findings.

  ---

  Explanation

  Macie Firewall Manager Inspector Shield makes Create an Amazon CloudWatch alarm that monitors AWS Shield Advanced metrics for an active DDoS event, the strongest match, because Inspector Shield Advanced wants receive asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. Inspector Shield Advanced wants receive depends on Create an Amazon CloudWatch alarm that monitors AWS Shield Advanced metrics for an active DDoS event, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. wants receive alerts DDoS attack is reinforced by A company is using Amazon Macie, AWS Firewall Manager, Amazon Inspector, and AWS Shield, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  DDoS attack occurs against requirement also supports Create an Amazon CloudWatch alarm that monitors AWS Shield Advanced metrics for an active DDoS event,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. against requirement CloudWatch alarm monitors would be weaker with Use Amazon Macie to detect an active DDoS event and create Amazon CloudWatch alarms that respond to Macie findings,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without

  tracing a custom chain. alarm monitors Shield Advanced metrics separates Use Amazon Inspector to review resources and invoke Amazon CloudWatch alarms for any resources that are vulnerable to DDoS attacks, and Create an Amazon CloudWatch alarm that monitors AWS Firewall Manager metrics for an active DDoS event, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. Advanced metrics active DDoS event points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 68:

  A security engineer needs to implement a logging solution that captures detailed information about objects in an Amazon S3 bucket. The solution must include details such as the IAM identity that makes the request and the time the object was accessed. The data must be structured and available in near real time.

  Which solution meets these requirements?

  A. Enable Amazon S3 server access logging on the S3 bucket. Create a new S3 bucket to store the logs. Analyze the logs from the logging S3 bucket.
  B. Enable AWS CloudTrail data event logging. Create a new S3 bucket to store the logs. Analyze the logs from the logging S3 bucket.
  C. Configure AWS Config rules to log access to the objects stored in the S3 bucket.
  D. Enable Amazon Macie to log access to the objects stored in the S3 bucket.
  A. Enable Amazon S3 server access logging on the S3 bucket. Create a new S3 bucket to store the logs. Analyze the logs from the logging S3 bucket.

  ---

  Explanation

  implement logging captures detailed information makes Enable AWS CloudTrail data event logging, Create a new S3 bucket to store the logs, Analyze the logs from the logging S3 bucket, the strongest match, because detailed information about objects bucket asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. detailed information about objects bucket depends on Enable AWS CloudTrail data event logging, Create a new S3 bucket to store the logs, Analyze the logs from the logging S3 bucket, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. objects bucket include details such is reinforced by A security engineer needs to implement a logging solution that captures detailed information about, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  details such IAM identity makes also supports Enable AWS CloudTrail data event logging, Create a new S3 bucket to store the logs, Analyze the logs from the logging S3 bucket,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. identity makes request time object would be weaker with Enable Amazon S3 server access logging on the S3 bucket, Create a new S3 bucket to store the logs, Analyze the logs from the logging S3, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. time object was accessed data separates Configure AWS Config rules to log access to the objects stored in the S3 bucket, and Enable

  Amazon Macie to log access to the objects stored in the S3 bucket, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. accessed data structured available near points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 69:

  A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client ' s own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company ' s AWS resources.

  Which additional step will meet these requirements?

  A. Update the S3 bucket policy to ensure that clients that use pre-signed URLs have the S3:Get* permission and the S3:List* permission to access S3 objects in the bucket.
  B. Add a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the policy condition to restrict access based on the s3:ResourceTag/ClientId tag of each invoice. Tag each generated invoice with the ID of its corresponding client.
  C. Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that has S3:GetObject permissions. Use the credentials to generate the pre-signed URLs.
  D. Generate an access key and a secret key for an IAM user that has S3:GetObject permissions on the S3 bucket. Embed the keys into the script. Use the keys to generate the pre-signed URLs.
  A. Update the S3 bucket policy to ensure that clients that use pre-signed URLs have the S3:Get* permission and the S3:List* permission to access S3 objects in the bucket.

  ---

  Explanation

  runs application EC2 instance generates makes Add a StringEquals condition to the IAM role policy for the EC2 instance profile, Configure the policy condition to restrict access based on the s3, ResourceTag/ClientId the strongest match, because instance application generates invoices stores asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. instance application generates invoices stores depends on Add a StringEquals condition to the IAM role policy for the EC2 instance profile, Configure the policy condition to restrict access based on the s3, ResourceTag/ClientId to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. invoices stores them bucket instance is reinforced by A company runs an application on an Amazon EC2 instance, The application generates invoices, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  bucket instance profile attached appropriate also supports Add a StringEquals condition to the IAM role policy for the EC2 instance profile, Configure the policy condition to restrict access based on the s3, ResourceTag/ClientId, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. attached instance appropriate access bucket would be weaker with Update the S3 bucket policy to ensure that clients that use pre-signed URLs have the S3, Get* permission and the S3, List* permission to access S3, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. access bucket share invoice multiple separates Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that and Generate an access key and a secret key for an IAM user that has S3, GetObject permissions on the S3 bucket, Embed the keys into the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. invoice multiple clients credentials client points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 70:

  A company wants to implement a content delivery network (CDN) for an upcoming product launch. The origin for distribution is a web server outside the AWS Cloud. The origin requires an authorization header from each request.

  Which solution will meet these requirements?

  A. Use AWS Global Accelerator to create a custom routing accelerator. Configure the accelerator to use TCP. Specify the web server's IP address. Include the required authorization header in the request. Configure the web server to respond to requests from authorized users by using a signed cookie in the response header.
  B. Create an Amazon CloudFront distribution. Configure CloudFront to use an origin access control (OAC). Specify the web server as the origin. Include the required authorization header in the OAC request. Configure the web server to respond to requests from authorized users by using a signed URL.
  C. Create an Amazon CloudFront distribution. Configure CloudFront to forward a custom header to the origin. Specify trusted key groups for the distribution. Configure the web server to respond to requests from authorized users by using a signed URL.
  D. Use AWS Global Accelerator to create an origin access control (OAC). Specify the web server as the origin. Include a custom header in the request. Configure the web server to respond to requests from authorized users by using a signed cookie in the response header.
  A. Use AWS Global Accelerator to create a custom routing accelerator. Configure the accelerator to use TCP. Specify the web server's IP address. Include the required authorization header in the request. Configure the web server to respond to requests from authorized users by using a signed cookie in the response header.

  ---

  Explanation

  wants implement content delivery network makes Create an Amazon CloudFront distribution, Configure CloudFront to forward a custom header to the origin, Specify trusted key groups for the distribution, Configure the web server the strongest match, because delivery network CDN upcoming product asks for a managed AWS capability which is important when security controls must be repeatable. delivery network CDN upcoming product depends on Create an Amazon CloudFront distribution, Configure CloudFront to forward a custom header to the origin, Specify trusted key groups for the distribution, Configure the web server to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. upcoming product launch origin distribution is reinforced by A company wants to implement a content delivery network (CDN) for an upcoming product, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities. origin distribution web server outside also supports Create an Amazon CloudFront distribution, Configure CloudFront to forward a custom header to the origin, Specify trusted key groups for the distribution, Configure the web server, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. server outside Cloud origin requires would be weaker with Use AWS Global Accelerator to create a custom routing accelerator, Configure the accelerator to use TCP, Specify the web server's IP address, Include the required authorization, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. origin requires authorization header request separates Create an Amazon CloudFront distribution, Configure CloudFront to use an origin access control (OAC), Specify the web server as the origin, Include the required authorization header and Use AWS Global Accelerator to create an origin access control (OAC), Specify the web server as the origin, Include a custom header in the request, Configure from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. header request requirements CloudFront distribution points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.