Free SCS-C03 Exam Dumps Preview

application standard tier SecureString parameters makes The application does not have the kms, Encrypt permission for the customer managed key, plus The customer managed key that is specified in the application has its key state set to Disabled, the strongest match, because SecureString parameters Systems Manager Parameter asks for a managed AWS capability and the design remains easier to govern across the environment. SecureString parameters Systems Manager Parameter depends on The application does not have the kms, Encrypt permission for the customer managed key, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. Manager Parameter Store application receiving is reinforced by A company's application uses standard tier SecureString parameters from AWS Systems Manager Parameter Store,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

application receiving error messages tries also supports The customer managed key that is specified in the application has its key state set to Disabled,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. messages tries update parameter KMS would be weaker with The customer managed key is already being used to encrypt another SecureString parameter,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. parameter KMS customer managed key separates Standard tier SecureString parameters cannot use a customer managed key for encryption, and The customer managed key that is specified in the application is using a key alias instead of a key ID, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. customer managed key encryption decryption points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

runs critical workloads premises data makes Enable AWS Elastic Disaster Recovery, Configure replication agents to continuously replicate each on-premises server, Enable the default staging area subnet configuration, the strongest match, because premises data center wants implement asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. premises data center wants implement depends on Enable AWS Elastic Disaster Recovery, Configure replication agents to continuously replicate each on-premises server, Enable the default staging area subnet configuration, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. wants implement based disaster recovery is reinforced by A company runs critical workloads in an on-premises data center, The company wants to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

disaster recovery achieve RTO less also supports Enable AWS Elastic Disaster Recovery, Configure replication agents to continuously replicate each on-premises server, Enable the default staging area subnet configuration,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. RTO less than hour continuously would be weaker with Use AWS Backup to directly replicate the on-premises servers to AWS, Enable cross-Region backup copying and data vaulting, Configure recovery points to match the defined RTO,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. hour continuously replicate physical virtual separates Configure an AWS Storage Gateway Volume Gateway to use Amazon Elastic Block Store (Amazon EBS) snapshots for recovery, Configure AWS Backup to manage the snapshots, Create and Create an AWS Direct Connect connection between the on-premises data center and AWS, Configure Amazon EventBridge to monitor for failures and to invoke AWS Lambda functions from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. physical virtual servers optimize costs points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

designed VPC segment private traffic makes Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone, plus Modify the route tables that are associated with each of the private subnets, Create a new route for the destination 0, 0, 0, 0/0, Specify the the strongest match, because private traffic public VPC includes asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. private traffic public VPC includes depends on Verify that a NAT gateway has been provisioned in the public subnet in each Availability Zone, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. traffic VPC includes Availability Zones is reinforced by A security engineer has designed a VPC to segment private traffic from public traffic,, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

Availability Zones provisioned Zone private also supports Modify the route tables that are associated with each of the private subnets, Create a new route for the destination 0, 0, 0, 0/0, Specify the, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. Availability Zone private subnet public would be weaker with Verify that a NAT gateway has been provisioned in the private subnet in each Availability Zone,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. subnet public created route tables separates Modify the route tables that are associated with each of the public subnets, Create a new route for local destinations to the VPC CIDR range, and Modify the route tables that are associated with each of the private subnets, Create a new route for the destination 0, 0, 0, 0/0, Specify the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. created route tables environment table points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

organization Organizations includes dedicated activity makes In the dedicated security account, create an Amazon S3 bucket, Configure S3 Object Lock incompliance modewith a retention period of 2 years, Set the bucket policy plus Create anAWS CloudTrail organization trail, Configure logs to be delivered to the Amazon S3 bucket in the dedicated security account, the strongest match, because includes dedicated activity member logged asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. includes dedicated activity member logged depends on In the dedicated security account, create an Amazon S3 bucket, Configure S3 Object Lock incompliance modewith a retention period of 2 years, Set the bucket policy to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. member logged reported dedicated retain is reinforced by A company has AWS accounts in an organization in AWS Organizations, The organization includes, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

dedicated retain activity logs secure also supports Create anAWS CloudTrail organization trail, Configure logs to be delivered to the Amazon S3 bucket in the dedicated security account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. logs secure storage location dedicated would be weaker with In the dedicated security account, create an Amazon S3 bucket, Configure S3 Object Lock incompliance modewith a retention period of 2 years, Set the bucket policy, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. location dedicated for2 years changes separates In the dedicated security account, create an Amazon S3 bucket with an S3 Lifecycle configuration that expires objects after 2 years, Allow member accounts to write and Turn on AWS CloudTrail in each account and forward logs to the dedicated security account by using AWS Lambda and Amazon Data Firehose, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. years changes deletions logs allowed points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

runs online game players sign makes Configure Amazon Cognito user pools to federate access to the game with third-party identity providers (IdPs), such as social IdPs, Migrate the game ' s authentication the strongest match, because players sign game their username asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. players sign game their username depends on Configure Amazon Cognito user pools to federate access to the game with third-party identity providers (IdPs), such as social IdPs, Migrate the game ' s authentication to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. their username password credentials stored is reinforced by A company runs an online game on AWS, When players sign up for the, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

credentials stored Aurora database number also supports Configure Amazon Cognito user pools to federate access to the game with third-party identity providers (IdPs), such as social IdPs, Migrate the game ' s authentication, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. database number users grown hundreds would be weaker with When a new player signs up, use an AWS Lambda function to automatically create an IAM access key and a secret access key,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. grown hundreds thousands players number separates Migrate the player credentials from the Aurora database to AWS Secrets Manager, and Issue API keys to new and existing players and use Amazon API Gateway for authentication, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. players number requests password resets points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

IAM user receives Access Denied makes The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key, the strongest match, because Access Denied message user attempts asks for a managed AWS capability while keeping the service responsibility clear for operations teams. Access Denied message user attempts depends on The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. user attempts access objects bucket is reinforced by An IAM user receives an Access Denied message when the user attempts to access, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

objects bucket user same configured also supports The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. bucket same configured server side would be weaker with The IAM policy needs to allow thekms, DescribeKeypermission,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. configured server side encryption KMS separates The S3 bucket has been changed to use the AWS managed key to encrypt objects at rest, and An S3 bucket policy needs to be added to allow the IAM user to access the objects, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. encryption KMS keys SSE encrypt points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

designing isolation procedure EC2 instances makes Create a network ACL that is associated with the target instance ' s subnet, Add a rule at the top of the inbound rule set to the strongest match, because EC2 instances part incident response asks for a managed AWS capability while keeping the service responsibility clear for operations teams. EC2 instances part incident response depends on Create a network ACL that is associated with the target instance ' s subnet, Add a rule at the top of the inbound rule set to to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. incident response plan isolate target is reinforced by A company ' s security engineer is designing an isolation procedure for Amazon EC2, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

isolate target instance block any also supports Create a network ACL that is associated with the target instance ' s subnet, Add a rule at the top of the inbound rule set to, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. block any traffic target instance would be weaker with Add an inbound rule to the security group to allow traffic from 0, 0, 0, 0/0 for all ports, Add an outbound rule to the security, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. target instance except traffic forensics separates Remove the port 22 security group rule, Attach an instance role policy that allows AWS Systems Manager Session Manager connections so that the forensics team can and Create an AWS Systems Manager document that adds a host-level firewall rule to block all inbound traffic and outbound traffic, Run the document on the target from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. traffic forensics team EC2 instances points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

immediately disable compromised IAM users makes Disable the user in IAM Identity Center and query the organizational event data store, the strongest match, because IAM users collect actions performed asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. IAM users collect actions performed depends on Disable the user in IAM Identity Center and query the organizational event data store, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. actions performed user last days is reinforced by A company must immediately disable compromised IAM users across all AWS accounts and collect, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

last days requirements Disable user also supports Disable the user in IAM Identity Center and query the organizational event data store,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. Disable user IAM Identity Center would be weaker with Disable the IAM user and query CloudTrail logs in Amazon S3 using Athena,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. Identity Center query organizational event separates Remove IAM policies and query logs in Security Hub, and Remove permission sets and query logs using CloudWatch Logs Insights, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. organizational event data store Disable points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

configured VPC Flow Logs publish makes The vpc-flow-logs, amazonaws, com principal cannot assume the role, the strongest match, because Logs publish CloudWatch minutes appear asks for a managed AWS capability which is important when security controls must be repeatable. Logs publish CloudWatch minutes appear depends on The vpc-flow-logs, amazonaws, com principal cannot assume the role, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. Logs minutes appear issue isolated is reinforced by A security engineer configured VPC Flow Logs to publish to Amazon CloudWatch Logs, After, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

appear issue isolated IAM role also supports The vpc-flow-logs, amazonaws, com principal cannot assume the role,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. IAM role associated VPC Flow would be weaker with logs, GetLogEvents is missing,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. VPC Flow Logs What could separates The engineer cannot assume the role, and The role cannot tag the log stream, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. What could reason vpc flow points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

implement identify any sensitive data makes Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data, Create an Amazon EventBridge rule to send notifications to the SNS topic, the strongest match, because sensitive data stored bucket report asks for a managed AWS capability which is important when security controls must be repeatable. sensitive data stored bucket report depends on Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data, Create an Amazon EventBridge rule to send notifications to the SNS topic, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. bucket report sensitive data Simple is reinforced by A security engineer needs to implement a solution to identify any sensitive data that, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

data bucket Simple Notification SNS also supports Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data, Create an Amazon EventBridge rule to send notifications to the SNS topic,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. Notification SNS topic requirements implementation would be weaker with Enable AWS Config, Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. requirements implementation effort Macie managed separates Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern, Program the Lambda function to send notifications to the and Enable Amazon GuardDuty, Configure AWS CloudTrail S3 data events, Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. Macie managed data identifiers identify points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

receives notice about suspicious activity makes Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination, Terminate the instance, the strongest match, because suspicious activity Linux based EC2 asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. suspicious activity Linux based EC2 depends on Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination, Terminate the instance, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. based EC2 instance Elastic Block is reinforced by A security engineer receives a notice about suspicious activity from a Linux-based Amazon EC2, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

Elastic Block Store EBS based also supports Ensure that the Amazon Elastic Block Store (Amazon EBS) volumes that are attached to the suspicious EC2 instance will not delete upon termination, Terminate the instance,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. EBS based storage instance making would be weaker with Log in to the suspicious instance and use the netstat command to identify remote connections, Use the IP addresses from these remote connections to create deny, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. instance making connections known malicious separates Update the outbound network ACL for the subnet in us-east-1b to explicitly deny all connections as the first rule, Replace the security group with a new and Create an AWS WAF web ACL that denies traffic to and from the suspicious instance, Attach the AWS WAF web ACL to the instance to mitigate from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. known malicious addresses instance development points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

developer accidentally committed IAM access makes Deactivate the exposed access key and review AWS CloudTrail events for activity by the access key, the strongest match, because IAM access key secret public asks for a managed AWS capability which is important when security controls must be repeatable. IAM access key secret public depends on Deactivate the exposed access key and review AWS CloudTrail events for activity by the access key, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. secret access key public repository is reinforced by A developer accidentally committed an IAM access key and secret access key to a, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

public repository team stop further also supports Deactivate the exposed access key and review AWS CloudTrail events for activity by the access key,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. stop further exposed key determine would be weaker with Delete the IAM user immediately and review only the current billing dashboard,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. key determine whether was used separates Attach an explicit deny policy to all roles in the account and wait for credential expiration, and Rotate the account root password and run Amazon Inspector on all compute resources, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. key was used exposure Deactivate points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

prepare EC2 instances quarantine during makes Configure IAM permissions for the SSM Agent to run the script as a Systems Manager Run Command document, the strongest match, because quarantine during incident Systems Manager asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. quarantine during incident Systems Manager depends on Configure IAM permissions for the SSM Agent to run the script as a Systems Manager Run Command document, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. Systems Manager Agent SSM installed is reinforced by A security engineer needs to prepare Amazon EC2 instances for quarantine during a security, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

SSM Agent installed script exists also supports Configure IAM permissions for the SSM Agent to run the script as a Systems Manager Run Command document,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. script exists install update forensic would be weaker with Track SSM Agent versions with AWS Config,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. update forensic tools quarantine EC2 separates Configure Session Manager to deny external connections, and Store the script in Amazon S3 and grant read access, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. quarantine EC2 instances during incident points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

migrate several applications require storing makes Configure the company's key management solution to integrate with AWS Systems Manager Parameter Store, the strongest match, because require storing more than 000 asks for a managed AWS capability which is important when security controls must be repeatable. require storing more than 000 depends on Configure the company's key management solution to integrate with AWS Systems Manager Parameter Store, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. than 000 credentials compliance requirements is reinforced by A company needs to migrate several applications to AWS, This will require storing more, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

compliance requirements password management system also supports Configure the company's key management solution to integrate with AWS Systems Manager Parameter Store,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. management system key rotation auditing would be weaker with Configure the company's key management solution to integrate with AWS Secrets Manager,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. rotation auditing integration third party separates Use an Amazon S3 encrypted bucket to store the secrets and configure the applications with the appropriate roles to access the secrets, and Configure the company's key management solution to integrate with AWS CloudHSM, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. third party secrets containers limited points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

systems administrator was attempting launch makes kms, CreateGrant the strongest match, because attempting launch new EC2 instance asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. attempting launch new EC2 instance depends on kms, CreateGrant to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. EC2 instance encrypted boot volume is reinforced by A systems administrator was attempting to launch a new Amazon EC2 instance with an, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

boot volume new KMS customer also supports kms, CreateGrant, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. KMS customer managed key EC2 would be weaker with kms, GetKeyRotationStatus, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. key EC2 console initially stated separates kms, GenerateRandom and kms, EnableKey from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. initially stated launch was successful points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

web application reads writes bucket makes Integrate with Cognito identity pools and use AssumeRoleWithWebIdentity to obtain AWS credentials, the strongest match, because writes bucket credentials authenticate API asks for a managed AWS capability which is important when security controls must be repeatable. writes bucket credentials authenticate API depends on Integrate with Cognito identity pools and use AssumeRoleWithWebIdentity to obtain AWS credentials, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. authenticate API calls bucket provide is reinforced by A company has a web application that reads from and writes to an Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

bucket provide application credentials make also supports Integrate with Cognito identity pools and use AssumeRoleWithWebIdentity to obtain AWS credentials,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. credentials make API calls Integrate would be weaker with Integrate with Cognito identity pools and use GetId to obtain AWS credentials,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. calls Integrate Cognito identity pools separates Integrate with Cognito user pools and use the ID token to obtain AWS credentials, and Integrate with Cognito user pools and use the access token to obtain AWS credentials, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. identity pools AssumeRoleWithWebIdentity obtain credentials points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

protect public web application runs makes Add a rate-based rule to the web ACL, Enable AWS Shield Advanced, Enable automatic application layer DDoS mitigation on the CloudFront distribution, the strongest match, because application runs VPC hosts origin asks for a managed AWS capability and the design remains easier to govern across the environment. application runs VPC hosts origin depends on Add a rate-based rule to the web ACL, Enable AWS Shield Advanced, Enable automatic application layer DDoS mitigation on the CloudFront distribution, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. VPC hosts origin CloudFront distribution is reinforced by A security engineer needs to protect a public web application that runs in a, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

CloudFront distribution application experienced multiple also supports Add a rate-based rule to the web ACL, Enable AWS Shield Advanced, Enable automatic application layer DDoS mitigation on the CloudFront distribution,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. experienced multiple layer DDoS attacks would be weaker with Enable AWS Shield Advanced on the CloudFront distribution, Configure alerts in Amazon CloudWatch for DDoS indicators,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. DDoS attacks WAF web ACL separates Enable AWS Shield Advanced and configure proactive engagement with the AWS DDoS Response Team (DRT), and Deploy AWS Network Firewall in the VPC, Create security policies that detect DDoS indicators, Create an AWS Lambda function to automatically update the web ACL rules from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. web ACL associated CloudFront distribution points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

incident response team troubleshoot incidents makes Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents, Reduce the scope of those permissions by using a the strongest match, because troubleshoot incidents incident response team asks for a managed AWS capability and that reduces the need for extra supervisory automation. troubleshoot incidents incident response team depends on Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents, Reduce the scope of those permissions by using a to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. response team temporary credentials STS is reinforced by A company uses an incident response team to troubleshoot incidents, The incident response team, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

credentials STS cross IAM role also supports Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents, Reduce the scope of those permissions by using a, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. IAM role access troubleshooting Occasionally would be weaker with Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents, Reduce the scope of those permissions by using a, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. troubleshooting Occasionally team member need separates Do not assign any permissions to the cross-account role initially, Assign a session policy to the role being assumed with the required permission for that type and Use an AWS Lambda function for each incident, Configure the function to create a temporary cross-account role that uses the AWS managed policy AWSSecurityIncidentResponseServiceRolePolicy, Reduce the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. member need respond multiple different points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

allows users download mobile app makes In the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core, plus Apply an AWS IoT Core policy to the device to allow " iot, Connect " with the resource set to " client /${iot, Connection, Thing, ThingName} the strongest match, because mobile app onto their phones asks for a managed AWS capability while keeping the service responsibility clear for operations teams. mobile app onto their phones depends on In the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. their phones app MQTT based is reinforced by A company allows users to download its mobile app onto their phones, The app, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

MQTT based connects IoT Core also supports Apply an AWS IoT Core policy to the device to allow " iot, Connect " with the resource set to " client /${iot, Connection, Thing, ThingName}, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. IoT Core subscribe specific client would be weaker with In the application, add a client ID check, Disconnect from the server if any special character is detected,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. specific client related topics Recently separates Apply an AWS IoT Core policy that allows " AWSIoTWirelessDataAccess " with the principal set to " client/${iot, Connection, Thing, ThingName} ", and Apply an AWS IoT Core policy to the device to allow " iot, Connect " with the resource set to " client /${iot, ClientId} ", from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. topics Recently discovered some malicious points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.

build code signing KMS asymmetric makes Create an Amazon S3 bucket with S3 Object Lock enabled, Create an AWS CloudTrail trail with log file validation enabled for KMS events, Store logs in the strongest match, because KMS asymmetric key store immutable asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. KMS asymmetric key store immutable depends on Create an Amazon S3 bucket with S3 Object Lock enabled, Create an AWS CloudTrail trail with log file validation enabled for KMS events, Store logs in to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. store immutable evidence key creation is reinforced by A company needs to build a code-signing solution using an AWS KMS asymmetric key, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

key creation usage compliance audit also supports Create an Amazon S3 bucket with S3 Object Lock enabled, Create an AWS CloudTrail trail with log file validation enabled for KMS events, Store logs in, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. compliance audit purposes requirements bucket would be weaker with Log application events to Amazon CloudWatch Logs and export them,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. requirements bucket Object Lock enabled separates Capture KMS API calls using EventBridge and store them in DynamoDB, and Track KMS usage with CloudWatch metrics and dashboards, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Lock enabled CloudTrail trail log points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

asked update CloudTrail log file makes Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail the strongest match, because log file prefix trail attempting asks for a managed AWS capability and the design remains easier to govern across the environment. log file prefix trail attempting depends on Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. trail attempting save change CloudTrail is reinforced by A security engineer is asked to update an AWS CloudTrail log file prefix for, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

change CloudTrail console receives error also supports Update the existing bucket policy in the Amazon S3 console with the new log file prefix, and then update the log file prefix in the CloudTrail, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. receives error message There problem would be weaker with Create a new trail with the updated log file prefix, and then delete the original trail,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. There problem bucket policy What separates Update the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform PutBucketPolicy, and then update the log file prefix and Update the existing bucket policy in the Amazon S3 console to allow the security engineer's principal to perform GetBucketPolicy, and then update the log file prefix from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. policy What enable save change points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

receives alert Support shows compromised makes Review AWS CloudTrail logs, Remove any unauthorized resources, Rotate all IAM access keys for the user that has the AWSCompromisedKeyQuarantineV3 policy attached, Remove the policy from the strongest match, because alert shows compromised access key asks for a managed AWS capability and that reduces the need for extra supervisory automation. alert shows compromised access key depends on Review AWS CloudTrail logs, Remove any unauthorized resources, Rotate all IAM access keys for the user that has the AWSCompromisedKeyQuarantineV3 policy attached, Remove the policy from to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. access key single standalone determine is reinforced by A company receives an alert from AWS Support, The alert shows a compromised access, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

standalone determine scope issue Then also supports Review AWS CloudTrail logs, Remove any unauthorized resources, Rotate all IAM access keys for the user that has the AWSCompromisedKeyQuarantineV3 policy attached, Remove the policy from, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. issue Then triage remediate requirements would be weaker with Delete the IAM user that has the AWSCompromisedKeyQuarantineV3 policy attached, Review Amazon CloudWatch for suspicious activity,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. remediate issue requirements Review CloudTrail separates Remove the AWSCompromisedKeyQuarantineV3 policy from the impacted IAM user, Review AWS CloudTrail logs, Remove any unauthorized resources, and Review Amazon CloudWatch logs for suspicious activity, Remove all unauthorized resources, Rotate the impacted IAM access keys, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. Review CloudTrail logs Remove any points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

implement logging captures detailed information makes Enable AWS CloudTrail data event logging, Create a new S3 bucket to store the logs, Analyze the logs from the logging S3 bucket, the strongest match, because detailed information about objects bucket asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. detailed information about objects bucket depends on Enable AWS CloudTrail data event logging, Create a new S3 bucket to store the logs, Analyze the logs from the logging S3 bucket, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. objects bucket include details such is reinforced by A security engineer needs to implement a logging solution that captures detailed information about, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

details such IAM identity makes also supports Enable AWS CloudTrail data event logging, Create a new S3 bucket to store the logs, Analyze the logs from the logging S3 bucket,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. identity makes request time object would be weaker with Enable Amazon S3 server access logging on the S3 bucket, Create a new S3 bucket to store the logs, Analyze the logs from the logging S3, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. time object was accessed data separates Configure AWS Config rules to log access to the objects stored in the S3 bucket, and Enable Amazon Macie to log access to the objects stored in the S3 bucket, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. accessed data structured available near points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

recently rotated host keys EC2 makes Manually upload the new host key to the AWS trusted host keys database, the strongest match, because keys EC2 instance trying access asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. keys EC2 instance trying access depends on Manually upload the new host key to the AWS trusted host keys database, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. trying access EC2 instance Connect is reinforced by A security engineer recently rotated the host keys for an Amazon EC2 instance, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

instance EC2 Connect feature However also supports Manually upload the new host key to the AWS trusted host keys database,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. Connect feature However receives error would be weaker with Import the key material into AWS Key Management Service (AWS KMS),, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. receives error failed host key separates Ensure that the AmazonSSMManagedInstanceCore policy is attached to the EC2 instance profile, and Create a new SSH key pair for the EC2 instance, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. host key validation rotation keys points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

web based application runs behind makes Create an AWS WAF web ACL for the ALB, Create a custom rule that blocks requests that contain the user agent string of the device emulator, the strongest match, because runs behind Application Load Balancer asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. runs behind Application Load Balancer depends on Create an AWS WAF web ACL for the ALB, Create a custom rule that blocks requests that contain the user agent string of the device emulator, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. Load Balancer ALB application experiencing is reinforced by A company has a web-based application that runs behind an Application Load Balancer (ALB),, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

application experiencing credential stuffing attack also supports Create an AWS WAF web ACL for the ALB, Create a custom rule that blocks requests that contain the user agent string of the device emulator,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. stuffing attack producing many failed would be weaker with Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string, Add an Amazon Simple Notification Service (Amazon SNS) topic, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. many failed login attempts attack separates Modify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack, and Create an AWS WAF web ACL for the ALB, Create a custom rule that allows requests from legitimate user agent strings, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. attempts attack coming many addresses points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

wants remove SSH keys permanently makes Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager, Provide the IAM user accounts with the strongest match, because keys permanently specific subset Linux asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. keys permanently specific subset Linux depends on Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager, Provide the IAM user accounts with to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. subset Linux EC2 instances same is reinforced by A company wants to remove all SSH keys permanently from a specific subset of, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

instances same IAM instance profile also supports Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager, Provide the IAM user accounts with, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. instance profile However individuals IAM would be weaker with Assign an IAM policy to the instance profile to allow the EC2 instances to be managed by AWS Systems Manager, Provide the IAM user accounts with, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. individuals IAM user need access separates Assign an IAM policy to the IAM user accounts to provide permission to use AWS Systems Manager Run Command, Remove the SSH keys from the EC2 and Assign an IAM policy to the IAM user accounts to provide permission to use the EC2 service in the AWS Management Console, Remove the SSH keys from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. need access instances SSH session points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

Organizations SCP root prevents sharing makes Edit the existing SCP to add a condition that excludes the marketing account, the strongest match, because prevents sharing resources external now asks for a managed AWS capability which is important when security controls must be repeatable. prevents sharing resources external now depends on Edit the existing SCP to add a condition that excludes the marketing account, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. external now allow only marketing is reinforced by A company uses AWS Organizations and has an SCP at the root that prevents, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

only marketing share resources externally also supports Edit the existing SCP to add a condition that excludes the marketing account,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. resources externally while preventing other would be weaker with Create a new SCP in the marketing account to explicitly allow sharing,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. preventing other doing same requirements separates Edit the SCP to include an Allow statement for the marketing account, and Use a permissions boundary in the marketing account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. same requirements Edit SCP add points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

configures stateless network ACL public makes Allow outbound TCP 443, allow inbound ephemeral response ports, and deny inbound database port traffic with a lower rule number than any broad allow, the strongest match, because ACL public subnet Instances need asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. ACL public subnet Instances need depends on Allow outbound TCP 443, allow inbound ephemeral response ports, and deny inbound database port traffic with a lower rule number than any broad allow, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. Instances subnet need initiate HTTPS is reinforced by A security engineer configures a stateless network ACL for a public subnet, Instances in, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

initiate HTTPS connections trusted external also supports Allow outbound TCP 443, allow inbound ephemeral response ports, and deny inbound database port traffic with a lower rule number than any broad allow,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. trusted external also block inbound would be weaker with Allow inbound TCP 443 only and deny outbound ephemeral ports,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. block inbound database connections subnet separates Allow outbound database port traffic and rely on security groups to permit HTTPS responses, and Deny all inbound ephemeral ports and allow only inbound database port traffic from the internet, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. connections subnet Allow outbound TCP points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

many buckets central inventory where makes Configure Amazon Macie delegated administration and enable sensitive data discovery for the organization, the strongest match, because inventory where sensitive data stored asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. inventory where sensitive data stored depends on Configure Amazon Macie delegated administration and enable sensitive data discovery for the organization, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. data stored Findings should visible is reinforced by A company has many S3 buckets across accounts and needs a central inventory of, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

should visible team support follow also supports Configure Amazon Macie delegated administration and enable sensitive data discovery for the organization,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. should support follow reviews Macie would be weaker with Enable Amazon Inspector on EC2 instances and use package vulnerability findings as the inventory,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. reviews Macie delegated administration enable separates Create a CloudTrail trail in each account and search for object names that appear sensitive, and Use AWS Backup reports to infer which buckets contain regulated data, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. administration enable sensitive data discovery points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

wants evaluate configuration changes specific makes Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes, the strongest match, because changes specific resource ensure compliance asks for a managed AWS capability and that reduces the need for extra supervisory automation. changes specific resource ensure compliance depends on Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. ensure resource compliance standards However is reinforced by A security engineer wants to evaluate configuration changes to a specific AWS resource to, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

standards However concerned about situation also supports Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. about situation several configuration changes would be weaker with Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes, Use the most recent API call to indicate the cumulative, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. configuration changes made resource quick separates Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes, Use the most recent API call to indicate the cumulative and Use AWS Cloud Map to detect the configuration changes, Generate a report of configuration changes from AWS Cloud Map to track the latest state by using from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. resource quick succession wants record points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

EC2 instances host frontend behind makes Use AWS Backup to create backups of the EC2 instances and S3 buckets every hour, Create AWS CloudFormation templates that replicate existing architecture components, Use a the strongest match, because frontend behind Application Load Balancer asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. frontend behind Application Load Balancer depends on Use AWS Backup to create backups of the EC2 instances and S3 buckets every hour, Create AWS CloudFormation templates that replicate existing architecture components, Use a to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. Load Balancer Elastic Block Store is reinforced by A company uses Amazon EC2 instances to host frontend services behind an Application Load, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

Block Store EBS volumes attached also supports Use AWS Backup to create backups of the EC2 instances and S3 buckets every hour, Create AWS CloudFormation templates that replicate existing architecture components, Use a, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. volumes attached EC2 instances buckets would be weaker with Use AWS Backup to create backups of the EBS volumes and S3 objects every day, Use Amazon Security Lake to create a centralized data lake for, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. instances buckets store large files separates Use Amazon Security Lake to create a centralized data lake for AWS CloudTrail logs and VPC flow logs, Use the logs for automated response, Enable AWS and Create EBS snapshots every 4 hours, Enable Amazon GuardDuty Malware Protection, Create automation to immediately restore the most recent snapshot for any EC2 instances that produce from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. large files images music implemented points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

running application west Region Key makes Allocate a new customer managed key to eu-north-1, Create the same alias name for both keys, Configure the application deployment to use the key alias, the strongest match, because Region application Key Management KMS asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. Region application Key Management KMS depends on Allocate a new customer managed key to eu-north-1, Create the same alias name for both keys, Configure the application deployment to use the key alias, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. Management KMS customer managed key is reinforced by A company is running an application in the eu-west-1 Region, The application uses an, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

managed key encrypt sensitive data also supports Allocate a new customer managed key to eu-north-1, Create the same alias name for both keys, Configure the application deployment to use the key alias,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. sensitive data plans deploy application would be weaker with Update the key policies in eu-west-1, Point the application in eu-north-1 to use the same customer managed key as the application in eu-west-1,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. deploy application north Region implement separates Allocate a new customer managed key to eu-north-1 to be used by the application that is deployed in that Region, and Allocate a new customer managed key to eu-north-1, Create an alias for eu--1, Change the application code to point to the alias for eu--1, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Region implement key management application points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

wants maintain IAM users roles makes Use AWS Identity and Access Management Access Analyzer to review last accessed information and to remove unused permissions, the strongest match, because users roles according principle privilege asks for a managed AWS capability so administrators can review the configuration without tracing a custom chain. users roles according principle privilege depends on Use AWS Identity and Access Management Access Analyzer to review last accessed information and to remove unused permissions, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and the design remains easier to govern across the environment. principle privilege plans audit IAM is reinforced by A security engineer for a company wants to maintain all IAM users and roles, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which is important when security controls must be repeatable.

audit IAM permissions once every also supports Use AWS Identity and Access Management Access Analyzer to review last accessed information and to remove unused permissions,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so the implementation follows the managed service contract instead of a workaround. once every 365 days view would be weaker with Use AWS CloudTrail logs to review IAM identity actions and to remove unused permissions,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and it avoids mixing detection, storage, deployment, and identity responsibilities. days view permissions IAM identity separates Use AWS Config to review configuration changes by each IAM identity and to remove unused permissions, and Use AWS Trusted Advisor to check the IAM identities that have elevated permissions and to remove unused permissions, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly while keeping the service responsibility clear for operations teams. IAM identity used last 365 points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and that reduces the need for extra supervisory automation.

Organizations IAM Identity Center administer makes Create the customer managed policy in every account where the permission set is assigned, Give the customer managed policy the same name and same permissions in the strongest match, because Center administer access creating permission asks for a managed AWS capability and that reduces the need for extra supervisory automation. Center administer access creating permission depends on Create the customer managed policy in every account where the permission set is assigned, Give the customer managed policy the same name and same permissions in to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. creating permission set IAM Identity is reinforced by A company that uses AWS Organizations is using AWS IAM Identity Center to administer, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

IAM Identity Center permission set also supports Create the customer managed policy in every account where the permission set is assigned, Give the customer managed policy the same name and same permissions in, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. permission set multiple managed policy would be weaker with Remove either the AWS managed policy or the customer managed policy from the permission set, Create a second permission set that includes the removed policy, Apply, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. managed policy customer attached permission separates Evaluate the logic of the AWS managed policy and the customer managed policy, Resolve any policy conflicts in the permission set before deployment, and Do not add the new permission set to the user, Instead, edit the user ' s existing permission set to include the AWS managed policy and from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. managed policy attached permission set points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

team manages Key Management KMS makes Create a key grant to allow the application team to use the KMS keys, Revoke the grant when the application team no longer needs access, the strongest match, because Management KMS customer managed keys asks for a managed AWS capability and the design remains easier to govern across the environment. Management KMS customer managed keys depends on Create a key grant to allow the application team to use the KMS keys, Revoke the grant when the application team no longer needs access, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. managed keys Only members team is reinforced by A security team manages a company's AWS Key Management Service (AWS KMS) customer managed, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

members team administer KMS keys also supports Create a key grant to allow the application team to use the KMS keys, Revoke the grant when the application team no longer needs access,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. KMS keys application team software would be weaker with Export the KMS key material to an on-premises hardware security module (HSM), Give the application team access to the key material,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. team software process temporary access separates Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals, Revert this change when the and Create a new KMS key by generating key material on premises, Import the key material to AWS KMS whenever the application team needs access, Grant the from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. temporary access keys occasionally team points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

GuardDuty finding indicates temporary credentials makes Revoke the active sessions for the instance profile role and add a temporary deny condition if needed, the strongest match, because temporary credentials EC2 instance profile asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. temporary credentials EC2 instance profile depends on Revoke the active sessions for the instance profile role and add a temporary deny condition if needed, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. instance profile being used unexpected is reinforced by A GuardDuty finding indicates that temporary credentials from an EC2 instance profile are being, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

used unexpected network location instance also supports Revoke the active sessions for the instance profile role and add a temporary deny condition if needed,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. location instance continue serving traffic would be weaker with Change the instance type to force the attacker to request new credentials,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. serving traffic short period while separates Remove inbound internet access to the instance security group only, and Enable default encryption on all S3 buckets in the account, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. period while application team prepares points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

team wants receive near real makes Create an Amazon EventBridge rule that matches AWS Health events for AWS_ABUSE_DOS_REPORT and publishes to SNS, the strongest match, because near real time email notifications asks for a managed AWS capability and the design remains easier to govern across the environment. near real time email notifications depends on Create an Amazon EventBridge rule that matches AWS Health events for AWS_ABUSE_DOS_REPORT and publishes to SNS, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. email notifications about abuse reports is reinforced by A company ' s security team wants to receive near-real-time email notifications about AWS, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

abuse reports related DoS attacks also supports Create an Amazon EventBridge rule that matches AWS Health events for AWS_ABUSE_DOS_REPORT and publishes to SNS,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. DoS attacks SNS topic already would be weaker with Poll Trusted Advisor for abuse notifications by using a Lambda function,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. topic already exists subscribed team separates Poll the AWS Support API for abuse cases by using a Lambda function, and Detect abuse reports by using CloudTrail logs and CloudWatch alarms, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. subscribed team What should next points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

developers Lambda function URLs invoke makes Use SCPs to deny all lambda, CreateFunctionUrlConfig and lambda, UpdateFunctionUrlConfig actions that have a lambda, FunctionUrlAuthType condition key value of NONE, the strongest match, because URLs invoke functions directly Thecompany asks for a managed AWS capability and the design remains easier to govern across the environment. URLs invoke functions directly Thecompany depends on Use SCPs to deny all lambda, CreateFunctionUrlConfig and lambda, UpdateFunctionUrlConfig actions that have a lambda, FunctionUrlAuthType condition key value of NONE, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. directly Thecompany ensure developers cannot is reinforced by A company's developers are using AWS Lambda function URLs to invoke functions directly, Thecompany, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

developers cannot deploy unauthenticated functions also supports Use SCPs to deny all lambda, CreateFunctionUrlConfig and lambda, UpdateFunctionUrlConfig actions that have a lambda, FunctionUrlAuthType condition key value of NONE,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. unauthenticated functions production wants requirement would be weaker with Require the developers to configure all function URLs to support cross-origin resource sharing (CORS) when the functions are called from a different domain,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. wants requirement Organizations require additional separates Use an AWS WAF delegated administrator account to view and block unauthenticated access to function URLs in production accounts, based on the OU of accounts that and Use SCPs to allow all lambda, CreateFunctionUrlConfig and lambda, UpdateFunctionUrlConfig actions that have a lambda, FunctionUrlAuthType condition key value of AWS_IAM, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. require additional work developers requirements points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

data scientists want artificial intelligence makes Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days, the strongest match, because artificial intelligence machine learning training asks for a managed AWS capability while keeping the service responsibility clear for operations teams. artificial intelligence machine learning training depends on Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and that reduces the need for extra supervisory automation. learning training models SageMaker large is reinforced by A company ' s data scientists want to create artificial intelligence and machine learning, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance which keeps the protection aligned with the stated AWS boundary.

SageMaker training models large datasets also supports Configure an S3 Lifecycle rule on the S3 bucket to delete objects after 45 days,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior so administrators can review the configuration without tracing a custom chain. large datasets bucket contain sensitive would be weaker with Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days, Create an S3, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and the design remains easier to govern across the environment. datasets contain sensitive information average separates Create an AWS Lambda function to check the last-modified date of the S3 objects and delete objects that are older than 45 days, Create an Amazon and Configure S3 Intelligent-Tiering on the S3 bucket to automatically transition objects to another storage class, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which is important when security controls must be repeatable. information average data scientists need points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so the implementation follows the managed service contract instead of a workaround.