Amazon SCS-C03 Online Practice Questions and Exam Preparation

Amazon SCS-C03 Online Questions & Answers

• Question 81:

  A company builds container images in several accounts and deploys serverless functions from those images. The security team needs a centralized view of software vulnerabilities and code risks. Test resources must not appear in operational dashboards.

  A. Enable AWS Shield Advanced and create alarms for protected resources that have test tags.
  B. Use Amazon Inspector with delegated administration and suppress findings for resources that are tagged as test or development.
  C. Use Amazon GuardDuty Malware Protection and exclude test resources with security group rules.
  D. Use AWS Config conformance packs and suppress all noncompliant resources in development accounts.
  A. Enable AWS Shield Advanced and create alarms for protected resources that have test tags.

  ---

  Explanation

  builds container images several deploys makes Use Amazon Inspector with delegated administration and suppress findings for resources that are tagged as test or development, the strongest match, because several deploys serverless functions those asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. several deploys serverless functions those depends on Use Amazon Inspector with delegated administration and suppress findings for resources that are tagged as test or development, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. functions those images team centralized is reinforced by A company builds container images in several accounts and deploys serverless functions from those, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  team centralized view software vulnerabilities also supports Use Amazon Inspector with delegated administration and suppress findings for resources that are tagged as test or development,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. software vulnerabilities code risks Test would be weaker with Enable AWS Shield Advanced and create alarms for protected resources that have test tags,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. risks Test resources appear operational separates Use Amazon GuardDuty Malware Protection and exclude test resources with security group rules, and Use AWS Config conformance packs and suppress all noncompliant resources in development accounts, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. appear operational dashboards Inspector delegated points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 82:

  A company's developers are using AWS Lambda function URLs to invoke functions directly. Thecompany must ensure that developers cannot configure or deploy unauthenticated functions in production accounts.

  The company wants to meet this requirement by using AWS Organizations. The solution must not require additional work for the developers.

  Which solution will meet these requirements?

  A. Require the developers to configure all function URLs to support cross-origin resource sharing (CORS) when the functions are called from a different domain.
  B. Use an AWS WAF delegated administrator account to view and block unauthenticated access to function URLs in production accounts, based on the OU of accounts that are using the functions.
  C. Use SCPs to allow all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions that have a lambda:FunctionUrlAuthType condition key value of AWS_IAM.
  D. Use SCPs to deny all lambda:CreateFunctionUrlConfig and lambda:UpdateFunctionUrlConfig actions that have a lambda:FunctionUrlAuthType condition key value of NONE.
  A. Require the developers to configure all function URLs to support cross-origin resource sharing (CORS) when the functions are called from a different domain.

  ---

  Explanation

  developers Lambda function URLs invoke makes Use SCPs to deny all lambda, CreateFunctionUrlConfig and lambda, UpdateFunctionUrlConfig actions that have a lambda, FunctionUrlAuthType condition key value of NONE, the strongest match, because URLs invoke functions directly Thecompany asks for a managed AWS capability and the design remains easier to govern across the environment. URLs invoke functions directly Thecompany depends on Use SCPs to deny all lambda, CreateFunctionUrlConfig and lambda, UpdateFunctionUrlConfig actions that have a lambda, FunctionUrlAuthType condition key value of NONE, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. directly Thecompany ensure developers cannot is reinforced by A company's developers are using AWS Lambda function URLs to invoke functions directly, Thecompany, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

  developers cannot deploy unauthenticated functions also supports Use SCPs to deny all lambda, CreateFunctionUrlConfig and lambda, UpdateFunctionUrlConfig actions that have a lambda, FunctionUrlAuthType condition key value of NONE,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. unauthenticated functions production wants requirement would be weaker with Require the developers to configure all function URLs to support cross-origin resource sharing (CORS) when the functions are called from a different domain,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. wants requirement Organizations require additional separates Use an AWS WAF delegated administrator account to view and block unauthenticated access to function URLs in production accounts, based on the OU of accounts that and Use SCPs to allow all lambda, CreateFunctionUrlConfig and lambda, UpdateFunctionUrlConfig actions that have a lambda, FunctionUrlAuthType condition key value of AWS_IAM, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. require additional work developers requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

• Question 83:

  A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets. The company needs to replicate the S3 objects from the company ' s primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region.

  Which solution will meet these requirements?

  A. Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
  B. Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
  C. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region.
  D. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 bucket in the secondary Region.
  A. Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.

  ---

  Explanation

  protect critical data being permanently makes Implement S3 Object Lock in compliance mode in the primary Region, Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region, the strongest match, because being permanently deleted data stored asks for a managed AWS capability and that reduces the need for extra supervisory automation. being permanently deleted data stored depends on Implement S3 Object Lock in compliance mode in the primary Region, Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. data stored buckets replicate objects is reinforced by A company needs a solution to protect critical data from being permanently deleted, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

  replicate objects primary Region secondary also supports Implement S3 Object Lock in compliance mode in the primary Region, Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. Region secondary disaster recovery requirements would be weaker with Configure AWS Backup to perform cross-Region S3 backups, Select a backup vault in the secondary Region, Enable AWS Backup Vault Lock in governance mode for the, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. disaster recovery requirements also ensure separates Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region, Create an S3 bucket policy to deny the s3, ReplicateDelete action and Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region, Configure S3 object versioning on the S3 bucket in the secondary from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. also ensure users administrator access points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

• Question 84:

  A company creates AWS Lambda functions from container images that are stored in Amazon Elastic Container Registry (Amazon ECR). The company needs to identify any software vulnerabilities in the container images and any code vulnerabilities in the Lambda functions.

  Which solution will meet these requirements?

  A. Enable Amazon GuardDuty. Configure Amazon ECR scanning and Lambda code scanning in GuardDuty.
  B. Enable Amazon GuardDuty. Configure Runtime Monitoring and Lambda Protection in GuardDuty.
  C. Enable Amazon Inspector. Configure Amazon ECR enhanced scanning and Lambda code scanning in Amazon Inspector.
  D. Enable AWS Security Hub. Configure Runtime Monitoring and Lambda Protection in Security Hub.
  A. Enable Amazon GuardDuty. Configure Amazon ECR scanning and Lambda code scanning in GuardDuty.

  ---

  Explanation

  creates Lambda functions container images makes Enable Amazon Inspector, Configure Amazon ECR enhanced scanning and Lambda code scanning in Amazon Inspector, the strongest match, because container images stored Elastic Registry asks for a managed AWS capability while keeping the service responsibility clear for operations teams. container images stored Elastic Registry depends on Enable Amazon Inspector, Configure Amazon ECR enhanced scanning and Lambda code scanning in Amazon Inspector, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. Elastic Container Registry ECR identify is reinforced by A company creates AWS Lambda functions from container images that are stored in Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

  ECR identify any software vulnerabilities also supports Enable Amazon Inspector, Configure Amazon ECR enhanced scanning and Lambda code scanning in Amazon Inspector,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. software vulnerabilities container images any would be weaker with Enable Amazon GuardDuty, Configure Amazon ECR scanning and Lambda code scanning in GuardDuty,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. images any code vulnerabilities Lambda separates Enable Amazon GuardDuty, Configure Runtime Monitoring and Lambda Protection in GuardDuty, and Enable AWS Security Hub, Configure Runtime Monitoring and Lambda Protection in Security Hub, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. vulnerabilities Lambda functions requirements Enable points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

• Question 85:

  A company plans to create Amazon S3 buckets to store log data. All the S3 buckets will have versioning enabled and will use the S3 Standard storage class.

  A security engineer needs to implement a solution that protects objects in the S3 buckets from deletion for 90 days. The solution must ensure that no object can be deleted during this time period, even by an administrator or the AWS account root user.

  Which solution will meet these requirements?

  A. Enable S3 Object Lock in governance mode. Set a legal hold of 90 days.
  B. Enable S3 Object Lock in governance mode. Set a retention period of 90 days.
  C. Enable S3 Object Lock in compliance mode. Set a retention period of 90 days.
  D. Create an S3 Glacier Vault Lock policy that prevents deletion for 90 days.
  A. Enable S3 Object Lock in governance mode. Set a legal hold of 90 days.

  ---

  Explanation

  plans buckets store log data makes Enable S3 Object Lock in compliance mode, Set a retention period of 90 days, the strongest match, because log data buckets versioning enabled asks for a managed AWS capability which is important when security controls must be repeatable. log data buckets versioning enabled depends on Enable S3 Object Lock in compliance mode, Set a retention period of 90 days, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. versioning enabled Standard storage class is reinforced by A company plans to create Amazon S3 buckets to store log data, All the, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

  storage class implement protects objects also supports Enable S3 Object Lock in compliance mode, Set a retention period of 90 days,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. protects objects buckets deletion days would be weaker with Enable S3 Object Lock in governance mode, Set a legal hold of 90 days,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. deletion days ensure object deleted separates Enable S3 Object Lock in governance mode, Set a retention period of 90 days, and Create an S3 Glacier Vault Lock policy that prevents deletion for 90 days, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. object deleted during time period points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

• Question 86:

  A company is planning to deploy a new log analysis environment. The company needs to analyze logs from multiple AWS services in near real time. The solution must provide the ability to search the logs and must send alerts to an existing Amazon Simple Notification Service (Amazon SNS) topic when specific logs match detection rules.

  Which solution will meet these requirements?

  A. Analyze the logs by using Amazon OpenSearch Service. Search the logs from the OpenSearch API. Use OpenSearch Service Security Analytics to match logs with detection rules and to send alerts to the SNS topic.
  B. Analyze the logs by using AWS Security Hub. Search the logs from the Findings page in Security Hub. Create custom actions to match logs with detection rules and to send alerts to the SNS topic.
  C. Analyze the logs by using Amazon CloudWatch Logs. Use a subscription filter to match logs with detection rules and to send alerts to the SNS topic. Search the logs manually by using CloudWatch Logs Insights.
  D. Analyze the logs by using Amazon QuickSight. Search the logs by listing the query results in a dashboard. Run queries to match logs with detection rules and to send alerts to the SNS topic.
  A. Analyze the logs by using Amazon OpenSearch Service. Search the logs from the OpenSearch API. Use OpenSearch Service Security Analytics to match logs with detection rules and to send alerts to the SNS topic.

  ---

  Explanation

  planning deploy new log analysis makes Analyze the logs by using Amazon OpenSearch Service, Search the logs from the OpenSearch API, Use OpenSearch Service Security Analytics to match logs with detection rules the strongest match, because log analysis environment analyze logs asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. log analysis environment analyze logs depends on Analyze the logs by using Amazon OpenSearch Service, Search the logs from the OpenSearch API, Use OpenSearch Service Security Analytics to match logs with detection rules to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. analyze logs multiple near real is reinforced by A company is planning to deploy a new log analysis environment, The company needs, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment. near real time provide ability also supports Analyze the logs by using Amazon OpenSearch Service, Search the logs from the OpenSearch API, Use OpenSearch Service Security Analytics to match logs with detection rules, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. provide ability search logs send would be weaker with Analyze the logs by using AWS Security Hub, Search the logs from the Findings page in Security Hub, Create custom actions to match logs with detection, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. logs send alerts Simple Notification separates Analyze the logs by using Amazon CloudWatch Logs, Use a subscription filter to match logs with detection rules and to send alerts to the SNS topic, and Analyze the logs by using Amazon QuickSight, Search the logs by listing the query results in a dashboard, Run queries to match logs with detection rules from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. Simple Notification SNS topic specific points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 87:

  A company runs an application on a fleet of Amazon EC2 instances. The application is accessible to users around the world. The company associates an AWS WAF web ACL with an Application Load Balancer (ALB) that routes traffic to the EC2 instances.

  A security engineer is investigating a sudden increase in traffic to the application. The security engineer discovers a significant amount of potentially malicious requests coming from hundreds of IP addresses in two countries. The security engineer wants to quickly limit the potentially malicious requests. The security engineer does not want to prevent legitimate users from accessing the application.

  Which solution will meet these requirements?

  A. Use AWS WAF to implement a rate-based rule for all incoming requests.
  B. Use AWS WAF to implement a geographical match rule to block all incoming traffic from the two countries.
  C. Edit the ALB security group to include a geographical match rule to block all incoming traffic from the two countries.
  D. Add deny rules to the ALB security group that prohibit incoming requests from the IP addresses.
  A. Use AWS WAF to implement a rate-based rule for all incoming requests.

  ---

  Explanation

  runs application fleet EC2 instances makes Use AWS WAF to implement a rate-based rule for all incoming requests, the strongest match, because EC2 instances application accessible users asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. EC2 instances application accessible users depends on Use AWS WAF to implement a rate-based rule for all incoming requests, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. accessible users around world associates is reinforced by A company runs an application on a fleet of Amazon EC2 instances, The application, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

  world associates WAF web ACL also supports Use AWS WAF to implement a rate-based rule for all incoming requests,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. web ACL Application Load Balancer would be weaker with Use AWS WAF to implement a geographical match rule to block all incoming traffic from the two countries,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. Load Balancer ALB routes traffic separates Edit the ALB security group to include a geographical match rule to block all incoming traffic from the two countries, and Add deny rules to the ALB security group that prohibit incoming requests from the IP addresses, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. routes traffic EC2 instances investigating points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

• Question 88:

  A company stores sensitive files in Amazon S3. The security policy requires all object uploads and downloads to use encrypted transport. Clients that attempt unencrypted transport must be denied, regardless of identity permissions.

  A. Enable default bucket encryption with Amazon S3 managed keys.
  B. Enable versioning on the bucket and require MFA Delete.
  C. Add a bucket policy that denies requests when aws:SecureTransport is false.
  D. Create an IAM policy that allows s3:GetObject only for administrator users.
  A. Enable default bucket encryption with Amazon S3 managed keys.

  ---

  Explanation

  stores sensitive files policy requires makes Add a bucket policy that denies requests when aws, SecureTransport is false, the strongest match, because policy requires object uploads downloads asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. policy requires object uploads downloads depends on Add a bucket policy that denies requests when aws, SecureTransport is false, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. uploads downloads encrypted transport Clients is reinforced by A company stores sensitive files in Amazon S3, The security policy requires all object, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  transport Clients attempt unencrypted denied also supports Add a bucket policy that denies requests when aws, SecureTransport is false,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. unencrypted transport denied regardless identity would be weaker with Enable default bucket encryption with Amazon S3 managed keys,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. regardless identity permissions Add bucket separates Enable versioning on the bucket and require MFA Delete, and Create an IAM policy that allows s3, GetObject only for administrator users, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. Add bucket policy denies requests points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 89:

  A company needs a cloud-based, managed desktop solution for its workforce of remote employees. The company wants to ensure that the employees can access the desktops only by using company-provided devices. A security engineer must design a solution that will minimize cost and management overhead.

  Which solution will meet these requirements?

  A. Deploy a custom virtual desktop infrastructure (VDI) solution with a restriction policy to allow access only from corporate devices.
  B. Deploy a fleet of Amazon EC2 instances. Assign an instance to each employee with certificate-based device authentication that uses Windows Active Directory.
  C. Deploy Amazon WorkSpaces. Set up a trusted device policy with IP blocking on the authentication gateway by using AWS Identity and Access Management (IAM).
  D. Deploy Amazon WorkSpaces. Create client certificates, and deploy them to trusted devices. Enable restricted access at the directory level.
  A. Deploy a custom virtual desktop infrastructure (VDI) solution with a restriction policy to allow access only from corporate devices.

  ---

  Explanation

  cloud based managed desktop workforce makes Deploy Amazon WorkSpaces, Create client certificates, and deploy them to trusted devices, Enable restricted access at the directory level, the strongest match, because desktop workforce remote employees wants asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. desktop workforce remote employees wants depends on Deploy Amazon WorkSpaces, Create client certificates, and deploy them to trusted devices, Enable restricted access at the directory level, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. employees wants ensure access desktops is reinforced by A company needs a cloud-based, managed desktop solution for its workforce of remote employees,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

  employees access desktops only provided also supports Deploy Amazon WorkSpaces, Create client certificates, and deploy them to trusted devices, Enable restricted access at the directory level,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. only provided devices design minimize would be weaker with Deploy a custom virtual desktop infrastructure (VDI) solution with a restriction policy to allow access only from corporate devices,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. design minimize cost management overhead separates Deploy a fleet of Amazon EC2 instances, Assign an instance to each employee with certificate- based device authentication that uses Windows Active Directory, and Deploy Amazon WorkSpaces, Set up a trusted device policy with IP blocking on the authentication gateway by using AWS Identity and Access Management (IAM), from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. management overhead requirements Deploy WorkSpaces points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

• Question 90:

  A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DNSSEC signing and has created a key-signing key (KSK).

  When the security engineer tries to test the configuration, the security engineer receives an error for a broken trust chain.

  What should the security engineer do to resolve this error?

  A. Replace the KSK with a zone-signing key (ZSK).
  B. Deactivate and then activate the KSK.
  C. Create a Delegation Signer (DS) record in the parent hosted zone.
  D. Create a Delegation Signer (DS) record in the subdomain.
  A. Replace the KSK with a zone-signing key (ZSK).

  ---

  Explanation

  implement DNS Extensions DNSSEC specific makes Create a Delegation Signer (DS) record in the parent hosted zone, the strongest match, because DNSSEC specific subdomain already registered asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain.

  DNSSEC specific subdomain already registered depends on Create a Delegation Signer (DS) record in the parent hosted zone, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. subdomain already registered Route enabled is reinforced by A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

  Route enabled DNSSEC signing created also supports Create a Delegation Signer (DS) record in the parent hosted zone,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. signing created key KSK tries would be weaker with Replace the KSK with a zone-signing key (ZSK),, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. signing key KSK tries test separates Deactivate and then activate the KSK, and Create a Delegation Signer (DS) record in the subdomain, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. tries test configuration receives error points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.