Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 71:

  A company must capture AWS CloudTrail data events and must retain the logs for 7 years. The logs must be immutable and must be available to be searched by complex queries. The company also needs to visualize the data from the logs.

  Which solution will meet these requirements MOST cost-effectively?

  A. Create a CloudTrail Lake data store. Implement CloudTrail Lake dashboards to visualize and query the results.
  B. Use the CloudTrail Event History feature in the AWS Management Console. Visualize and query the results in the console.
  C. Send the CloudTrail logs to an Amazon S3 bucket. Provision a persistent Amazon EMR cluster that has access to the S3 bucket. Enable S3 Object Lock on the S3 bucket. Use Apache Spark to perform queries. Use Amazon QuickSight for visualizations.
  D. Send the CloudTrail logs to a log group in Amazon CloudWatch Logs. Set the CloudWatch Logs stream to send the data to an Amazon OpenSearch Service domain. Enable cold storage for the OpenSearch Service domain. Use OpenSearch Dashboards for visualizations and queries.
  A. Create a CloudTrail Lake data store. Implement CloudTrail Lake dashboards to visualize and query the results.

  ---

  Explanation

  capture CloudTrail data events retain makes Create a CloudTrail Lake data store, Implement CloudTrail Lake dashboards to visualize and query the results, the strongest match, because events retain logs years immutable asks for a managed AWS capability and the design remains easier to govern across the environment. events retain logs years immutable depends on Create a CloudTrail Lake data store, Implement CloudTrail Lake dashboards to visualize and query the results, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. years logs immutable available searched is reinforced by A company must capture AWS CloudTrail data events and must retain the logs for, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  available searched complex queries also also supports Create a CloudTrail Lake data store, Implement CloudTrail Lake dashboards to visualize and query the results,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. queries also visualize data logs would be weaker with Use the CloudTrail Event History feature in the AWS Management Console, Visualize and query the results in the console,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. data logs requirements cost effectively separates Send the CloudTrail logs to an Amazon

  S3 bucket, Provision a persistent Amazon EMR cluster that has access to the S3 bucket, Enable S3 Object Lock and Send the CloudTrail logs to a log group in Amazon CloudWatch Logs, Set the CloudWatch Logs stream to send the data to an Amazon OpenSearch Service from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. cost effectively CloudTrail Lake data points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 72:

  A company uses AWS Organizations and has an SCP at the root that prevents sharing resources with external accounts. The company now needs to allow only the marketing account to share resources externally while preventing all other accounts from doing so. All accounts are in the same OU.

  Which solution will meet these requirements?

  A. Create a new SCP in the marketing account to explicitly allow sharing.
  B. Edit the existing SCP to add a condition that excludes the marketing account.
  C. Edit the SCP to include an Allow statement for the marketing account.
  D. Use a permissions boundary in the marketing account.
  A. Create a new SCP in the marketing account to explicitly allow sharing.

  ---

  Explanation

  Organizations SCP root prevents sharing makes Edit the existing SCP to add a condition that excludes the marketing account, the strongest match, because prevents sharing resources external now asks for a managed AWS capability which is important when security controls must be repeatable. prevents sharing resources external now depends on Edit the existing SCP to add a condition that excludes the marketing account, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. external now allow only marketing is reinforced by A company uses AWS Organizations and has an SCP at the root that prevents, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  only marketing share resources externally also supports Edit the existing SCP to add a condition that excludes the marketing account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. resources externally while preventing other would be weaker with Create a new SCP in the marketing account to explicitly allow sharing,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. preventing other doing same requirements separates Edit the SCP to include an Allow statement for the marketing account, and Use a permissions boundary in the marketing account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. same requirements Edit SCP add points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 73:

  A company uses an incident response team to troubleshoot incidents. The incident response team must use temporary credentials from AWS STS for cross-account IAM role access when troubleshooting.

  Occasionally, each team member will need to respond to multiple different types of incidents simultaneously.

  Based on the type of incident, the company wants to dynamically assign minimal permissions to whichever team member responds.

  Which solution will meet these requirements?

  A. Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents. Reduce the scope of those permissions by using a session policy.
  B. Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents. Reduce the scope of those permissions by using a permissions boundary.
  C. Do not assign any permissions to the cross-account role initially. Assign a session policy to the role being assumed with the required permission for that type of incident.
  D. Use an AWS Lambda function for each incident. Configure the function to create a temporary cross-account role that uses the AWS managed policy AWSSecurityIncidentResponseServiceRolePolicy. Reduce the scope of those permissions by using a permissions boundary.
  A. Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents. Reduce the scope of those permissions by using a session policy.

  ---

  Explanation

  incident response team troubleshoot incidents makes Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents, Reduce the scope of those permissions by using a the strongest match, because troubleshoot incidents incident response team asks for a managed AWS capability and that reduces the need for extra supervisory automation. troubleshoot incidents incident response team depends on Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents, Reduce the scope of those permissions by using a to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. response team temporary credentials STS is reinforced by A company uses an incident response team to troubleshoot incidents, The incident response team, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  credentials STS cross IAM role also supports Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents, Reduce the scope of those permissions by using a, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. IAM role access troubleshooting Occasionally would be weaker with Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents, Reduce the scope of those permissions by using a, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. troubleshooting Occasionally team member need separates Do not assign any permissions to the cross-account role initially, Assign a session policy to the role being assumed with the required permission for that type and Use an

  AWS Lambda function for each incident, Configure the function to create a temporary cross-account role that uses the AWS managed policy AWSSecurityIncidentResponseServiceRolePolicy, Reduce the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. member need respond multiple different points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 74:

  A company has an AWS account that hosts a production application. The company receives an email notification that Amazon GuardDuty has detected an Impact:IAMUser/AnomalousBehavior finding in the account. A security engineer needs to run the investigation playbook for this security incident and must collect and analyze the information without affecting the application.

  Which solution will meet these requirements MOST quickly?

  A. Log in to the AWS account by using read-only credentials. Review the GuardDuty finding for details about the IAM credentials that were used. Use the IAM console to add a DenyAll policy to the IAM principal.
  B. Log in to the AWS account by using read-only credentials. Review the GuardDuty finding to determine which API calls initiated the finding. Use Amazon Detective to review the API calls in context.
  C. Log in to the AWS account by using administrator credentials. Review the GuardDuty finding for details about the IAM credentials that were used. Use the IAM console to add a DenyAll policy to the IAM principal.
  D. Log in to the AWS account by using read-only credentials. Review the GuardDuty finding to determine which API calls initiated the finding. Use AWS CloudTrail Insights and AWS CloudTrail Lake to review the API calls in context.
  A. Log in to the AWS account by using read-only credentials. Review the GuardDuty finding for details about the IAM credentials that were used. Use the IAM console to add a DenyAll policy to the IAM principal.

  ---

  Explanation

  hosts production application receives email makes Log in to the AWS account by using read-only credentials, Review the GuardDuty finding to determine which API calls initiated the finding, Use Amazon Detective to the strongest match, because receives email notification GuardDuty detected asks for a managed AWS capability while keeping the service responsibility clear for operations teams. receives email notification GuardDuty detected depends on Log in to the AWS account by using read-only credentials, Review the GuardDuty finding to determine which API calls initiated the finding, Use Amazon Detective to to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. GuardDuty detected Impact IAMUser AnomalousBehavior is reinforced by A company has an AWS account that hosts a production application, The company receives, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  IAMUser AnomalousBehavior finding run investigation also supports Log in to the AWS account by using read-only credentials, Review the GuardDuty finding to determine which API calls initiated the finding, Use Amazon Detective to, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. run investigation playbook incident collect would be weaker with Log in to the AWS account by using read-only credentials, Review the GuardDuty finding for details about the IAM credentials that were used, Use the IAM, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. incident collect analyze information without separates Log in to the AWS account by using administrator credentials, Review the GuardDuty finding for details about the IAM credentials that were used, Use the IAM and Log in to the AWS account by using read-only credentials, Review the GuardDuty finding to determine which API calls initiated the finding, Use AWS CloudTrail Insights from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. information without affecting application requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 75:

  A security team manages encryption keys and an operations team manages storage buckets. The company wants separation of duties so that a mistake by only one team cannot expose plaintext sensitive data stored in a bucket.

  A. Use server-side encryption with Amazon S3 managed keys and allow the operations team to manage all bucket policies.
  B. Require server-side encryption with a customer managed AWS KMS key in the bucket policy and control key usage through the KMS key policy.
  C. Store the encryption key as an object in the same bucket and deny public access to the bucket.
  D. Use client-side encryption but allow the operations team to manage both the key material and the bucket.
  A. Use server-side encryption with Amazon S3 managed keys and allow the operations team to manage all bucket policies.

  ---

  Explanation

  team manages encryption keys operations makes Require server-side encryption with a customer managed AWS KMS key in the bucket policy and control key usage through the KMS key policy, the strongest match, because keys operations team manages storage asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. keys operations team manages storage depends on Require server-side encryption with a customer managed AWS KMS key in the bucket policy and control key usage through the KMS key policy, to place the control at the same account, resource, identity, key, log,

  network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. manages storage buckets wants separation is reinforced by A security team manages encryption keys and an operations team manages storage buckets, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  wants separation duties mistake only also supports Require server-side encryption with a customer managed AWS KMS key in the bucket policy and control key usage through the KMS key policy,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. mistake only team cannot expose would be weaker with Use server-side encryption with Amazon S3 managed keys and allow the operations team to manage all bucket policies,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. cannot expose plaintext sensitive data separates Store the encryption key as an object in the same bucket and deny public access to the bucket, and Use client-side encryption but allow the operations team to manage both the key material and the bucket, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. sensitive data stored bucket Require points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 76:

  A company uses SAML federation with IAM to provide internal users with SSO for their AWS accounts. The company's identity provider certificate was rotated as part of its normal lifecycle. Shortly after, users started receiving the following error when attempting to log in:

  "Error: Response Signature Invalid (Service: AWSSecurityTokenService; Status Code: 400; Error Code:

  InvalidIdentityToken)"

  A security engineer needs to address the immediate issue and ensure that it will not occur again.

  Which combination of steps should the security engineer take to accomplish this? (Select TWO.)

  A. Download a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.
  B. During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary certificate to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
  C. Download a new copy of the SAML metadata file from the identity provider. Upload the new metadata to the IAM identity provider entity configured for the SAML integration in question.
  D. During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary certificate to the identity provider. Generate a new copy of the metadata file and create a new IAM identity provider entity. Upload the metadata file to the new IAM identity provider entity. Perform automated or manual rotation of the certificate when required.
  E. Download a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity. Update the identity provider configurations to pass a new IAM identity provider entity name in the SAML assertion.
  A. Download a new copy of the SAML metadata file from the identity provider. Create a new IAM identity provider entity. Upload the new metadata file to the new IAM identity provider entity.
  B. During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary certificate to the identity provider. Generate a new metadata file and upload it to the IAM identity provider entity. Perform automated or manual rotation of the certificate when required.

  ---

  Explanation

  SAML federation IAM provide internal makes During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary certificate to the identity provider, Generate a plus Download a new copy of the SAML metadata file from the identity provider, Upload the new metadata to the IAM identity provider entity configured for the the strongest match, because provide internal users SSO their asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. provide internal users SSO their depends on During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary certificate to the identity provider, Generate a to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. SSO their identity provider certificate is reinforced by A company uses SAML federation with IAM to provide internal users with SSO for, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

  provider certificate was rotated part also supports Download a new copy of the SAML metadata file from the identity provider, Upload the new metadata to the IAM identity provider entity configured for the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. rotated part normal lifecycle Shortly would be weaker with Download a new copy of the SAML metadata file from the identity provider, Create a new IAM identity provider entity, Upload the new metadata file to, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. lifecycle Shortly users started receiving separates During the next certificate rotation period and before the current certificate expires, add a new certificate as the secondary certificate to the identity provider, Generate a and Download a new copy of the SAML metadata file from the identity provider, Create a new IAM identity provider entity, Upload the new metadata file to from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. started receiving error attempting log points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

• Question 77:

  A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and download the toolset's code. The company discovers that the code contains an IAM access key and secret key that provide access to internal resources in the company ' s AWS environment. A security engineer must implement a solution to identify whether unauthorized usage of the exposed credentials has occurred.

  The solution also must prevent any additional usage of the exposed credentials.

  Which combination of steps will meet these requirements? (Select TWO.)

  A. Use AWS Identity and Access Management Access Analyzer to determine which resources the exposed credentials accessed and who used them.
  B. Deactivate the exposed IAM access key from the user ' s IAM account.
  C. Create a rule in Amazon GuardDuty to block the access key in the source code from being used.
  D. Create a new IAM access key and secret key for the user whose credentials were exposed.
  E. Generate an IAM credential report. Check the report to determine when the user that owns the access key last logged in.
  A. Use AWS Identity and Access Management Access Analyzer to determine which resources the exposed credentials accessed and who used them.
  B. Deactivate the exposed IAM access key from the user ' s IAM account.

  ---

  Explanation

  development team creating open source makes Deactivate the exposed IAM access key from the user ' s IAM account, plus Generate an IAM credential report, Check the report to determine when the user that owns the access key last logged in, the strongest match, because open source toolset manage software asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. open source toolset manage software depends on Deactivate the exposed IAM access key from the user ' s IAM account, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. manage software SaaS application stores is reinforced by A development team is creating an open source toolset to manage a company's software, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  application stores code public repository also supports Generate an IAM credential report, Check the report to determine when the user that owns the access key last logged in,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. public repository anyone view download would be weaker with Use AWS Identity and Access Management Access Analyzer to determine which resources the exposed credentials accessed and who used them,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. view download toolset code discovers separates Create a rule in Amazon GuardDuty to block the access key in the source code from being used, and Create a new IAM access key and secret key for the user whose credentials were exposed, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. code discovers contains IAM access points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

• Question 78:

  A public subnet contains two Amazon EC2 instances. The subnet has a custom network ACL. A security engineer is designing a solution to improve the subnet security. The solution must allow outbound traffic to an internet service that uses TLS through port 443. The solution also must deny inbound traffic that is destined for MySQL port 3306.

  Which network ACL rule set meets these requirements?

  A. 443. Use inbound rule 200 to deny traffic on TCP port3306. Use outbound rule 100 to allow traffic on TCP port 443.
  B. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port 443.
  C. Use inbound rule 100 to allow traffic on TCP port range 1024-65535. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
  D. 3306. Use inbound rule 200 to allow traffic on TCP port443. Use outbound rule 100 to allow traffic on TCP port 443.
  A. 443. Use inbound rule 200 to deny traffic on TCP port3306. Use outbound rule 100 to allow traffic on TCP port 443.

  ---

  Explanation

  public subnet contains EC2 instances makes Use inbound rule 100 to deny traffic on TCP port 3306, Use inbound rule 200 to allow traffic on TCP port range 1024-65535, Use outbound rule the strongest match, because EC2 instances subnet network ACL asks for a managed AWS capability and the design remains easier to govern across the environment. EC2 instances subnet network ACL depends on Use inbound rule 100 to deny traffic on TCP port 3306, Use inbound rule 200 to allow traffic on TCP port range 1024-65535, Use outbound rule to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. network ACL designing improve subnet is reinforced by A public subnet contains two Amazon EC2 instances, The subnet has a custom network, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  improve subnet allow outbound traffic also supports Use inbound rule 100 to deny traffic on TCP port 3306, Use inbound rule 200 to allow traffic on TCP port range 1024-65535, Use outbound rule, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. outbound traffic internet TLS through would be weaker with Use inbound rule 100 to allow traffic on TCP port 443, Use inbound rule 200 to deny traffic on TCP port 3306, Use outbound rule 100, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. TLS through port 443 also separates Use inbound rule 100 to allow traffic on TCP port range 1024-65535, Use inbound rule 200 to deny traffic on TCP port 3306, Use outbound rule and Use inbound rule 100 to deny traffic on TCP port 3306, Use inbound rule 200 to allow traffic on TCP port 443, Use outbound rule 100 from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. 443 also deny inbound traffic points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 79:

  A company uses AWS Organizations. The company subscribes to AWS Shield Advanced. The company must share third-party firewall logs from all its accounts with the Shield Response Team. The company stores the logs in an Amazon S3 bucket that uses server-side encryption with S3 managed keys (SSE-S3).

  Which combination of steps will meet these requirements? (Select TWO.)

  A. Use the aws shield associate-drt-log-bucket command to grant the Shield Response Team access to the bucket.
  B. Configure multi-account support by creating a delegated administrator account for Shield Advanced.
  C. In the delegated administrator account, configure Shield Advanced to forward events to AWS Security Hub CSPM.
  D. Create an IAM role and attach the AWSShieldDRTAccessPolicy policy. Create a trust policy with the drt.shield.amazonaws.com service principal.
  E. Configure auto-enable preferences in Organizations to enable Shield Advanced as the organization adds new member accounts.
  A. Use the aws shield associate-drt-log-bucket command to grant the Shield Response Team access to the bucket.
  B. Configure multi-account support by creating a delegated administrator account for Shield Advanced.

  ---

  Explanation

  Organizations subscribes Shield Advanced share makes Use the aws shield associate-drt-log-bucket command to grant the Shield Response Team access to the bucket, plus Create an IAM role and attach the AWSShieldDRTAccessPolicy policy, Create a trust policy with the drt, shield, amazonaws, com service principal, the strongest match, because Advanced share third party firewall asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. Advanced share third party firewall depends on Use the aws shield associate-drt-log-bucket command to grant the Shield Response Team access to the bucket, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. party firewall logs Shield Response is reinforced by A company uses AWS Organizations, The company subscribes to AWS Shield Advanced, The company, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  Shield Response Team stores logs also supports Create an IAM role and attach the AWSShieldDRTAccessPolicy policy, Create a trust policy with the drt, shield, amazonaws, com service principal,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. stores logs bucket server side would be weaker with Configure multi-account support by creating a delegated administrator account for Shield Advanced,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. server side encryption managed keys separates In the delegated administrator account, configure Shield Advanced to forward events to AWS Security Hub CSPM, and Configure auto-enable preferences in Organizations to enable Shield Advanced as the organization adds new member accounts, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. managed keys SSE combination steps points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 80:

  A company is planning to migrate its applications to AWS in a single AWS Region. The company's applications will use a combination of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, and Amazon S3 buckets. The company wants to complete the migration as quickly as possible.

  All the applications must meet the following requirements:

  - Data must be encrypted at rest.

  - Data must be encrypted in transit.

  - Endpoints must be monitored for anomalous network traffic.

  Which combination of steps should a security engineer take to meet these requirements with the LEAST effort? (Select THREE.)

  A. Install the Amazon Inspector agent on EC2 instances by using AWS Systems Manager Automation.
  B. Enable Amazon GuardDuty in all AWS accounts.
  C. Create VPC endpoints for Amazon EC2 and Amazon S3. Update VPC route tables to use only the secure VPC endpoints.
  D. Configure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from ACM.
  E. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-meta-side-encryption.
  F. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-server-side-encryption.
  A. Install the Amazon Inspector agent on EC2 instances by using AWS Systems Manager Automation.
  B. Enable Amazon GuardDuty in all AWS accounts.

  ---

  Explanation

  planning migrate applications single Region makes Enable Amazon GuardDuty in all AWS accounts, plus Configure AWS Certificate Manager (ACM), Configure the load balancers to use certificates from ACM, plus Use AWS Key Management Service (AWS KMS) for key management, Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-server-side-encryption, the strongest match, because single Region applications combination EC2 asks for a managed AWS capability and the design remains easier to govern across the environment. single Region applications combination EC2 depends on Enable Amazon GuardDuty in all AWS accounts, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. combination EC2 instances Elastic Load is reinforced by A company is planning to migrate its applications to AWS in a single AWS, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  Elastic Load Balancing ELB balancers also supports Configure AWS Certificate Manager (ACM), Configure the load balancers to use certificates from ACM,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. ELB load balancers buckets wants would be weaker with Install the Amazon Inspector agent on EC2 instances by using AWS Systems Manager Automation,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. buckets wants complete migration quickly separates Create VPC endpoints for Amazon EC2 and Amazon S3, Update VPC route tables to use only the secure VPC endpoints, and Use AWS Key Management Service (AWS KMS) for key management, Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-meta-side-encryption, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. migration quickly possible applications requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.