SCS-C03 practice questions 61–70

1. Question 61 · 79 in bank

   A company is using Amazon Made, AWS Firewall Manager. Amazon Inspector, and AWS Shield Advanced in its AWS account. The company wants to receive alerts if a DDoS attack occurs against the account. Which solution will meet this requirement?

   • AUse Macie to detect an active DDoS event. Create Amazon CloudWatch alarms that respond to Macie findings.
   • BUse Amazon Inspector to review resources and to invoke Amazon CloudWatch alarms for any resources that are vulnerable to DDoS attacks.
   • CCreate an Amazon CloudWatch alarm that monitors Firewall Manager metrics for an active DDoS event.
   • DCreate an Amazon CloudWatch alarm that monitors Shield Advanced metrics for an active DDoS event.

   Show answer

   Answer: D

   Next question

2. Question 62 · 79 in bank

   A company runs critical workloads in an on-premises data center. The company wants to implement an AWS based disaster recovery (DR) solution that will achieve an RTO of less than 1 hour. The company needs to continuously replicate physical and virtual servers. The company must optimize costs for data storage and bandwidth usage. The DR solution must be automated. Which solution will meet these requirements?

   • AUse AWS Backup to directly replicate the on-premises servers to AWS. Enable cross-Region backup copying and data vaulting. Configure recovery points to match the defined RTO. Use AWS Step Functions to automate recovery steps.
   • BConfigure an AWS Storage Gateway Volume Gateway to use Amazon Elastic Block Store (Amazon EBS) snapshots for recovery. Configure AWS Backup to manage the snapshots. Create automated recovery procedures.
   • CEnable AWS Elastic Disaster Recovery. Configure replication agents to continuously replicate each on-premises server. Enable the default staging area subnet configuration.
   • DCreate an AWS Direct Connect connection between the on-premises data center and AWS. Configure Amazon EventBridge to monitor for failures and to invoke AWS Lambda functions that launch preconfigured Amazon EC2 instances from AMIs in the event of an incident.

   Show answer

   Answer: C

   Next question

3. Question 63 · 79 in bank

   Select 2

   A company in France uses Amazon Cognito with the Cognito Hosted UI as an identity broker for sign-in and sign-up processes. The company is marketing an application and expects that all the application's users will come from France. When the company launches the application, the company’s security team observes fraudulent sign-ups for the application. Most of the fraudulent registrations are from users outside of France. The security team needs a solution to perform custom validation at sign-up. Based on the results of the validation, the solution must accept or deny the registration request. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate a pre sign-up AWS Lambda trigger. Associate the Amazon Cognito function with the Amazon Cognito user pool.
   • BUse a geographic match rule statement to configure an AWS WAF web ACL. Associate the web ACL with the Amazon Cognito user pool.
   • CConfigure an app client for the application’s Amazon Cognito user pool. Use the app client ID to validate the requests in the hosted UI.
   • DUpdate the application’s Amazon Cognito user pool to configure a geographic restriction setting.
   • EUse Amazon Cognito to configure a social identity provider (IdP) to validate the requests on the hosted UI.

   Show answer

   Answer: AB

   Next question

4. Question 64 · 79 in bank

   A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company wants to centrally give users the ability to access Amazon Q Developer. Which solution will meet this requirement?

   • AEnable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application.
   • BEnable Amazon Cognito and create a new identity pool for Amazon Q Developer.
   • CEnable Amazon Cognito and set up Amazon Q Developer as an AWS managed application
   • DEnable AWS IAM Identity Center and create a new identity pool for Amazon Q Developer.

   Show answer

   Answer: A

   Next question

5. Question 65 · 79 in bank

   Select 2

   An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connect to the website during the attack period. The ecommerce company's security team is worried about future potential attacks and wants to prepare for such events. The company needs to minimize downtime in its response to similar attacks in the future. Which steps would help achieve this? (Choose two.)

   • AEnable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
   • BSubscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack.
   • CUse VPC Flow Logs to monitor network traffic and an AWS Lambda function to automatically block an attacker's IP using security groups.
   • DSet up an Amazon EventBridge rule to monitor the AWS CloudTrail events in real time, use AWS Config rules to audit the configuration, and use AWS Systems Manager for remediation.
   • EUse AWS WAF to create rules to respond to such attacks.

   Show answer

   Answer: BE

   Next question

6. Question 66 · 79 in bank

   A company has two AWS accounts: Account A and Account B. Each account has a VPC. An application that runs in the VPC in Account A needs to write to an Amazon S3 bucket in Account B. The application in Account A already has permission to write to the S3 bucket in Account B. The application and the S3 bucket are in the same AWS Region. The company cannot send network traffic over the public internet. Which solution will meet these requirements?

   • AIn both accounts, create a transit gateway and VPC attachments in a subnet in each Availability Zone. Update the VPC route tables.
   • BDeploy a software VPN appliance in Account A. Create a VPN connection between the software VPN appliance and a virtual private gateway in Account B.
   • CCreate a VPC peering connection between the VPC in Account A and the VPC in Account B. Update the VPC route tables, network ACLs, and security groups to allow network traffic between the peered IP ranges.
   • DIn Account A, create a gateway VPC endpoint for Amazon S3. Update the VPC route table in Account A.

   Show answer

   Answer: D

   Next question

7. Question 67 · 79 in bank

   A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off. What is the MOST efficient way to implement this solution?

   • AUse AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.
   • BCreate an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging API.
   • CCreate an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLogging event name to invoke an AWS Lambda function to call the StartLogging API.
   • DMonitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.

   Show answer

   Answer: A

   Next question

8. Question 68 · 79 in bank

   A company maintains both on-premises legacy systems and resources in AWS. The AWS resources include an Amazon DynamoDB table and an Amazon S3 bucket. The on-premises legacy systems need to connect to DynamoDB and Amazon S3 on a regular basis. The company currently uses a bastion host in a public subnet in a VPC. The company connects to the bastion host by using an SSH private key that the company stores on-premises. The instance profile that is assigned to the bastion host has full access to Amazon S3 and DynamoDB. A security team issues a new internal policy that requires all bastion hosts to be removed. The policy requires all systems to authenticate by using certificate-based authentication. Which solution will meet these requirements?

   • ASet up an AWS Direct Connect connection and create a VPN connection to a VPC that has access to VPC endpoints for the required services.
   • BSet up the on-premises systems to use AWS IAM Roles Anywhere to authenticate.
   • CUse AWS Private Certificate Authority to issue SSL certificates to give on-premises systems access to resources on AWS.
   • DCreate an IAM user that has permission to temporarily assume an IAM role and to use temporarily assumed role credentials to access the required resources.

   Show answer

   Answer: B

   Next question

9. Question 69 · 79 in bank

   A company uses an organization in AWS Organizations to manage multiple AWS accounts. Users access AWS accounts by using IAM users and secret access keys. A security team requires all access to accounts to use temporary security credentials that expire after 60 minutes. Users must use a SAML-based identity provider (IdP) to access the accounts. Which solution will meet these requirements?

   • AEnable access to the AWS Security Token Service (AWS STS). Ensure that users run the get-session-token AWS CLI command with an appropriate duration. Require users to use STS temporary credentials to access AWS accounts.
   • BSet up AWS IAM Identity Center and configure an external IdP. Configure permission sets that allow the access that the users require. Configure a session duration limit. Require the users to retrieve SSO credentials by using the AWS CLI. Remove the IAM users from the AWS accounts.
   • CSet up AWS Secrets Manager and Amazon Cognito in each AWS account. Configure a Cognito identity pool to use an external IdP and connect to Secrets Manager. Enable managed secret rotation in Secrets Manager. Ensure that the users run the get-secret-value AWS CLI command to access the AWS accounts.
   • DEnable AWS IAM Roles Anywhere in the organization management account. Ensure that users install the credential helper tool. Configure IAM roles within the management account with an appropriate session duration. Ensure that the users retrieve temporary credentials from the credential helper tool to access the AWS accounts.

   Show answer

   Answer: B

   Next question

10. Question 70 · 79 in bank

    A company begins to use AWS WAF after experiencing an increase in traffic to the company's public web applications. A security engineer needs to determine if the increase in traffic is because of application-layer attacks. The security engineer needs a solution to analyze AWS WAF traffic. Which solution will meet this requirement?

    • AConfigure AWS WAF to send logs to a trail in AWS CloudTrail. Create an Amazon Data Firehose delivery stream to send the logs to Amazon OpenSearch Service. Use OpenSearch Dashboards and an Amazon Athena connector to query the logs.
    • BConfigure AWS WAF to send logs to an Amazon S3 bucket Configure an OpenSearch table with a partition projection of the S3 bucket. Use OpenSearch to query the data in the S3 bucket
    • CConfigure AWS WAF to send logs to an Amazon S3 bucket. Configure an Amazon Athena table with a partition projection of the S3 bucket. Use Athena to query the data in the S3 bucket.
    • DConfigure AWS WAF to send logs to a trail in AWS CloudTrail. Create an Amazon Data Firehose delivery stream to send the logs to an Amazon S3 bucket. Use Amazon Athena to query the data in the S3 bucket.

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C03 practice, question 61. 79 questions available.