Amazon SCS-C03 - Questions & Answers

implement control keys cryptographic operations makes To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster, For auditing, use AWS CloudTrail, the strongest match, because cryptographic operations symmetric keys key asks for a managed AWS capability and that reduces the need for extra supervisory automation. cryptographic operations symmetric keys key depends on To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster, For auditing, use AWS CloudTrail, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. keys key material generated used is reinforced by A security engineer needs to implement a solution to create and control the keys, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

generated used key store backed also supports To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster, For auditing, use AWS CloudTrail,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. store backed CloudHSM cluster symmetric would be weaker with To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster, For auditing, use Amazon Athena,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. cluster symmetric asymmetric data key separates To create the keys, use Amazon S3 and the custom key stores with the CloudHSM cluster, For auditing, use AWS CloudTrail, and To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster, For auditing, use Amazon GuardDuty, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. data key pairs local applications points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

Organizations nested OUs manage compliance makes Configure a delegated administrator account for AWS CloudFormation, Create a CloudFormation StackSet in the delegated administrator account targeting the organization root with automatic deployment enabled, the strongest match, because manage compliance monitoring runs Lambda asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. manage compliance monitoring runs Lambda depends on Configure a delegated administrator account for AWS CloudFormation, Create a CloudFormation StackSet in the delegated administrator account targeting the organization root with automatic deployment enabled, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. monitoring runs Lambda function invoked is reinforced by A company is using AWS Organizations with nested OUs to manage AWS accounts, The, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

function invoked EventBridge Scheduler deploy also supports Configure a delegated administrator account for AWS CloudFormation, Create a CloudFormation StackSet in the delegated administrator account targeting the organization root with automatic deployment enabled,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. Scheduler deploy monitoring organization avoid would be weaker with Create a CloudFormation stack set in the organization ' s management account and manually add new accounts,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. organization avoid management required requirements separates Use Systems Manager delegated administration and Automation to deploy the Lambda function and schedule, and Create a Systems Manager Automation runbook in the management account and share it to accounts, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. management required requirements delegated administrator points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.

received GuardDuty alert indicating finding makes Open the IAM console and revoke all IAM sessions that are associated with the instance profile, the strongest match, because indicating finding involving EC2 instance asks for a managed AWS capability and the design remains easier to govern across the environment. indicating finding involving EC2 instance depends on Open the IAM console and revoke all IAM sessions that are associated with the instance profile, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which is important when security controls must be repeatable. EC2 instance hosts primary website is reinforced by A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so the implementation follows the managed service contract instead of a workaround.

primary website GuardDuty finding received also supports Open the IAM console and revoke all IAM sessions that are associated with the instance profile,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and it avoids mixing detection, storage, deployment, and identity responsibilities. finding received read UnauthorizedAccess IAMUser would be weaker with Open the EC2 console and remove any security groups that allow inbound traffic from 0, 0, 0, 0/0,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere while keeping the service responsibility clear for operations teams. UnauthorizedAccess IAMUser InstanceCredentialExfiltration confirmed malicious separates Install the AWS Systems Manager Agent on the EC2 instance and run an inventory report, and Install the Amazon Inspector agent on the host and run an assessment with the CVE rules package, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and that reduces the need for extra supervisory automation. confirmed malicious actor used API points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which keeps the protection aligned with the stated AWS boundary.

builds document management systems recently makes Add an S3 bucket policy that denies all S3 actions for condition "aws, SecureTransport", "false", the strongest match, because systems recently performed review application asks for a managed AWS capability which is important when security controls must be repeatable. systems recently performed review application depends on Add an S3 bucket policy that denies all S3 actions for condition "aws, SecureTransport", "false", to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so the implementation follows the managed service contract instead of a workaround. review application showed uploads documents is reinforced by A company that builds document management systems recently performed a security review of its, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and it avoids mixing detection, storage, deployment, and identity responsibilities.

showed uploads documents through signed also supports Add an S3 bucket policy that denies all S3 actions for condition "aws, SecureTransport", "false",, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior while keeping the service responsibility clear for operations teams. through signed URLs could occur would be weaker with Ensure that all client implementations are using HTTPS to upload documents into the application,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere and that reduces the need for extra supervisory automation. could occur application without encryption separates Configure the s3-bucket-ssl-requests-only managed rule in AWS Config, and Add an S3 bucket ACL with a grantee of AllUsers, a permission of WRITE, and a condition of secureTransport, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly which keeps the protection aligned with the stated AWS boundary. without encryption transit implement prevents points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads so administrators can review the configuration without tracing a custom chain.

team receive notification whenever access makes Deploy an AWS Config managed rule to run on a periodic basis of 24 hours, Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to the strongest match, because whenever access key been rotated asks for a managed AWS capability so the implementation follows the managed service contract instead of a workaround. whenever access key been rotated depends on Deploy an AWS Config managed rule to run on a periodic basis of 24 hours, Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario and it avoids mixing detection, storage, deployment, and identity responsibilities. been rotated more days develop is reinforced by A company's security team needs to receive a notification whenever an AWS access key, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance while keeping the service responsibility clear for operations teams.

days develop provides notifications automatically also supports Deploy an AWS Config managed rule to run on a periodic basis of 24 hours, Select the access-keys-rotated managed rule, and set the maxAccessKeyAge parameter to, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and that reduces the need for extra supervisory automation. notifications automatically requirements amount effort would be weaker with Create a script to export a, csv file from the AWS Trusted Advisor check for IAM access key rotation, Load the script into an AWS Lambda, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which keeps the protection aligned with the stated AWS boundary. amount effort Deploy Config managed separates Create a script to download the IAM credentials report on a periodic basis, Load the script into an AWS Lambda function that will run on a and Create an AWS Lambda function that queries the IAM API to list all the users, Iterate through the users by using the ListAccessKeys operation, Verify that from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so administrators can review the configuration without tracing a custom chain. Config managed rule run periodic points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and the design remains easier to govern across the environment.

detect unauthenticated access Elastic Kubernetes makes Enable Amazon GuardDuty and use EKS Audit Log Monitoring, the strongest match, because Elastic Kubernetes EKS clusters require asks for a managed AWS capability and it avoids mixing detection, storage, deployment, and identity responsibilities. Elastic Kubernetes EKS clusters require depends on Enable Amazon GuardDuty and use EKS Audit Log Monitoring, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario while keeping the service responsibility clear for operations teams. clusters require additional configuration EKS is reinforced by A company needs to detect unauthenticated access to its Amazon Elastic Kubernetes Service (Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and that reduces the need for extra supervisory automation.

configuration EKS deployment requirements operational also supports Enable Amazon GuardDuty and use EKS Audit Log Monitoring,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which keeps the protection aligned with the stated AWS boundary. requirements operational effort Enable GuardDuty would be weaker with Install a third-party security add-on,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so administrators can review the configuration without tracing a custom chain. Enable GuardDuty EKS Audit Log separates Enable AWS Security Hub and monitor Kubernetes findings, and Monitor CloudWatch Container Insights metrics for EKS, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and the design remains easier to govern across the environment. Audit Log Monitoring Install third points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads which is important when security controls must be repeatable.

runs microservices architecture Kubernetes containers makes Designate an Amazon GuardDuty administrator account in the organization's management account, Enable GuardDuty for all accounts, Enable EKS Protection and RDS Protection in the GuardDuty administrator the strongest match, because Kubernetes containers Elastic EKS Aurora asks for a managed AWS capability and that reduces the need for extra supervisory automation. Kubernetes containers Elastic EKS Aurora depends on Designate an Amazon GuardDuty administrator account in the organization's management account, Enable GuardDuty for all accounts, Enable EKS Protection and RDS Protection in the GuardDuty administrator to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario which keeps the protection aligned with the stated AWS boundary. Kubernetes EKS Aurora organization Organizations is reinforced by A company runs its microservices architecture in Kubernetes containers on AWS by using Amazon, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance so administrators can review the configuration without tracing a custom chain.

organization Organizations manage hundreds host also supports Designate an Amazon GuardDuty administrator account in the organization's management account, Enable GuardDuty for all accounts, Enable EKS Protection and RDS Protection in the GuardDuty administrator, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior and the design remains easier to govern across the environment. hundreds host different microservices implement would be weaker with Designate a monitoring account, Share Amazon CloudWatch Logs from all accounts, Use Amazon Inspector to evaluate the logs,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere which is important when security controls must be repeatable. microservices implement monitoring logs resources separates Centralize CloudTrail logs in Amazon S3 and analyze them with Amazon Athena, and Stream CloudWatch Logs to Amazon Kinesis and analyze them with custom AWS Lambda functions, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly so the implementation follows the managed service contract instead of a workaround. logs resources include automatic detection points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads and it avoids mixing detection, storage, deployment, and identity responsibilities.

detects bot activity targeting Cognito makes Enable Amazon Cognito threat protection, the strongest match, because targeting Cognito user pool endpoints asks for a managed AWS capability which keeps the protection aligned with the stated AWS boundary. targeting Cognito user pool endpoints depends on Enable Amazon Cognito threat protection, to place the control at the same account, resource, identity, key, log, network, or assessment boundary named by the scenario so administrators can review the configuration without tracing a custom chain. pool endpoints block malicious requests is reinforced by A company detects bot activity targeting Amazon Cognito user pool endpoints, The solution must, because that wording favors direct service configuration over scripts, forwarding jobs, manual reviews, or account-by-account maintenance and the design remains easier to govern across the environment.

malicious requests while maintaining access also supports Enable Amazon Cognito threat protection,, since the service keeps policy evaluation, collection, encryption, deployment, or access analysis inside the AWS plane that owns the behavior which is important when security controls must be repeatable. maintaining access legitimate users requirements would be weaker with Restrict access to authenticated users only,, because that alternative addresses a neighboring activity while the main security action still has to be solved elsewhere so the implementation follows the managed service contract instead of a workaround. users requirements Enable Cognito threat separates Associate AWS WAF with the Cognito user pool, and Monitor requests with CloudWatch, from the requested outcome, since those choices can help a wider architecture without satisfying the complete constraint directly and it avoids mixing detection, storage, deployment, and identity responsibilities. Cognito threat protection Restrict access points to a design with clearer responsibility, cleaner operations, and better reviewability for a security team managing AWS workloads while keeping the service responsibility clear for operations teams.