SCS-C03 practice questions 71–79

1. Question 71 · 79 in bank

   A company with 50 AWS accounts managed through AWS Organizations needs to set up a centralized threat detection solution. The solution must identify suspicious and potentially malicious activity across all accounts in the organization. The company uses AWS Control Tower and wants to centralize security findings into an audit account. A security team must receive email alerts within 5 minutes of any new security findings. Which solution will meet these requirements?

   • AConfigure Amazon GuardDuty with a delegated administrator in the audit account. Enable GuardDuty across all member accounts through the delegated administrator account. Create an Amazon EventBridge rule to send GuardDuty findings to an Amazon SNS topic that delivers email notifications to the security team.
   • BSet up Amazon GuardDuty in each member account, and create IAM roles to allow cross-account access from the audit account. Configure Amazon CloudWatch alarms in each account to monitor for security findings and to send notifications to an Amazon Simple Notification Service (Amazon SNS) topic in the audit account.
   • CEnable AWS Config in the audit account and create custom rules to detect security issues across the organization. Use AWS Systems Manager to collect security findings from all member accounts and to store the findings in a centralized Amazon S3 bucket. Create an AWS Lambda function to monitor the S3 bucket and to send email notifications to the security team when new findings are detected.
   • DDeploy Amazon Inspector agents across all Amazon EC2 instances in the organization. Configure the Amazon Inspector agents to report to a central Amazon Inspector console in the audit account. Create Amazon EventBridge rules in each member account to forward findings to an Amazon Simple Notification Service (Amazon SNS) topic in the audit account.

   Show answer

   Answer: A

   Next question

2. Question 72 · 79 in bank

   A security engineer needs to protect a public web application that runs in a VPC. The VPC hosts the origin for an Amazon CloudFront distribution. The application has experienced multiple layer 7 DDoS attacks. An AWS WAF web ACL is associated with the CloudFront distribution. The web ACL contains one AWS managed rule to protect against known IP addresses that have bad reputations. The security engineer must configure an automated solution that detects and mitigates layer 7 DDoS attacks in real time with no manual effort. Which solution will meet these requirements?

   • AEnable AWS Shield Advanced on the CloudFront distribution. Configure alerts in Amazon CloudWatch for DDoS indicators.
   • BEnable AWS Shield Advanced and configure proactive engagement with the AWS DDoS Response Team.
   • CDeploy AWS Network Firewall in the VPCreate security policies that detect DDoS indicators. Create an AWS Lambda function to automatically update the web ACL rules during an attack.
   • DAdd a rate-based rule to the web ACL. Enable AWS Shield Advanced. Enable automatic application layer DDoS mitigation on the CloudFront distribution.

   Show answer

   Answer: D

   Next question

3. Question 73 · 79 in bank

   A company uses AWS Organizations with all features enabled. The company has enabled AWS Security Hub in all member accounts and in all AWS Regions. The company has created a VPC in the eu-central-1 Region in a member AWS account. A security engineer has verified that no security group rules in the VPC allow inbound traffic from all IP addresses on TCP port 22. The security engineer needs an automated system. The system must prevent the creation of security group rules in the VPC that allow traffic from all IP addresses on TCP port 22. Which solution will meet these requirements?

   • AEnable an AWS CloudTrail organization trail that logs to an Amazon CloudWatch Logs log group. Create a CloudWatch alarm based on a log group metric filter. Configure the alarm to publish to an Amazon Simple Notification Service (Amazon SNS) topic when a security group rule is added that allows inbound traffic from all IP addresses. Subscribe the security engineer's email address to the SNS topic.
   • BCreate an Amazon EventBridge rule that filters for Security Hub findings about security group rules that allow inbound traffic from all IP addresses on TCP port 22. Configure the EventBridge rule to target an AWS Lambda function that removes the unwanted security group rule.
   • CCreate an SCP that prevents the creation or modification of security group rules that allow inbound traffic from all IP addresses on TCP port 22.
   • DDeploy AWS Network Firewall with a rule that inspects all inbound traffic and prevents incoming traffic on TCP port 22.

   Show answer

   Answer: C

   Next question

4. Question 74 · 79 in bank

   A company runs an application on a fleet of Amazon EC2 instances. The application is accessible to users around the world. The company associates an AWS WAF web ACL with an Application Load Balancer (ALB) that routes traffic to the EC2 instances. A security engineer is investigating a sudden increase in traffic to the application. The security engineer discovers a significant amount of potentially malicious requests coming from hundreds of IP addresses in two countries. The security engineer wants to quickly limit the potentially malicious requests. The security engineer does not want to prevent legitimate users from accessing the application. Which solution will meet these requirements?

   • AUse AWS WAF to implement a rate-based rule for all incoming requests.
   • BUse AWS WAF to implement a geographical match rule to block all incoming traffic from the two countries.
   • CEdit the ALB security group to include a geographical match rule to block all incoming traffic from the two countries
   • DAdd deny rules to the ALB security group that prohibit incoming requests from the IP addresses.

   Show answer

   Answer: A

   Next question

5. Question 75 · 79 in bank

   A company uses AWS Organizations to manage an organization that consists of three workload OUs: Production. Development, and Testing. The company uses AWS CloudFormation templates to define and deploy workload infrastructure in AWS accounts that are associated with the OUs. Different SCPs are attached to each workload OU. The company successfully deployed a CloudFormation stack update to workloads in the Development OU and the Testing OU. When the company uses the same CloudFormation template to deploy the stack update in an account in the Production OU, the update fails. The error message reports insufficient IAM permissions. What is the FIRST step that a security engineer should take to troubleshoot this issue?

   • AReview the AWS CloudTrail logs in the account in the Production OU. Search for any failed API calls from CloudFormation during the deployment attempt.
   • BRemove all the SCPs that are attached to the Production OU. Rerun the CloudFormation stack update to determine if the SCPs were preventing the CloudFormation API calls
   • CConfirm that the role used by CloudFormation has sufficient permissions to create, update, and delete the resources that are referenced in the CloudFormation template
   • DMake all the SCPs that are attached to the Production OU the same as the SCPs that are attached to the Testing OU.

   Show answer

   Answer: A

   Next question

6. Question 76 · 79 in bank

   A security engineer needs to implement a logging solution that captures detailed information about objects in an Amazon S3 bucket. The solution must include details such as the IAM identity that makes the request and the time the object was accessed. The data must be structured and available in near real time. Which solution meets these requirements?

   • AEnable Amazon S3 server access logging on the S3 bucket. Create a new S3 bucket to store the logs. Analyze the logs from the logging S3 bucket.
   • BEnable AWS CloudTrail data event logging. Create a new S3 bucket to store the logs. Analyze the logs from the logging S3 bucket.
   • CConfigure AWS Config rules to log access to the objects stored in the S3 bucket.
   • DEnable Amazon Macie to log access to the objects stored in the S3 bucket.

   Show answer

   Answer: B

   Next question

7. Question 77 · 79 in bank

   A company needs to develop a code-signing application that will use a certificate authority (CA) to sign a code-signing certificate. The solution must use an AWS Key Management Service (AWS KMS) asymmetric key. The solution needs to collect and store immutable evidence about the creation, origin, and use of the KMS key for compliance purposes. This information must be made available to internal auditors. Which solution meets these requirements?

   • ACreate an Amazon S3 bucket with S3 Object Lock enabled. Create an AWS CloudTrail trail with an event selector and log file validation enabled for all kms.amazonaws.com CreateKey events. Configure the event selector to send the CreateKey events to the S3 bucket. Create the KMS key. Update the event selector to filter for API calls that reference the KMS key ARN. Provide the auditors with access to the S3 bucket.
   • BImplement logging for application operations that reference the KMS key. Ensure that the logs contain all associated metadata. Store the logs in an Amazon CloudWatch Logs log group. Configure an automated export of the log group Send the export to the auditors.
   • CCreate an Amazon DynamoDB table that the auditors can access. Create an AWS Lambda function that an Amazon EventBridge rule invokes. Configure the EventBridge rule to monitor KMS API calls. Configure the EventBridge rule to filter for all API calls that reference the KMS key ARN. Configure the Lambda function to store the contents of the API calls in the DynamoDB table.
   • DSet up Amazon CloudWatch Logs Insights with a custom metric to track KMS key usage. Visualize the metrics by using a CloudWatch dashboard with real-time monitoring. Configure CloudWatch alarms. Use a subscription filter to replicate the data to a separate account for the auditors to review.

   Show answer

   Answer: A

   Next question

8. Question 78 · 79 in bank

   A company is planning to deploy a new log analysis environment. The company needs to implement a solution to analyze logs from multiple AWS services in near real time. The solution must provide the ability to search the logs. The solution also must send alerts to an existing Amazon Simple Notification Service (Amazon SNS) topic when specific logs match detection rules. Which solution will meet these requirements?

   • AAnalyze the logs by using Amazon OpenSearch Service. Search the logs from the OpenSearch API. Use OpenSearch Service Security Analytics to match logs with detection rules and to send alerts to the SNS topic.
   • BAnalyze the logs by using AWS Security Hub. Search the logs from the Findings page in Security Hub. Create custom actions to match logs with detection rules and to send alerts to the SNS topic.
   • CAnalyze the logs by using Amazon CloudWatch Logs. Use a subscription filter to match logs with detection rules and to send alerts to the SNS topic. Search the logs manually by using CloudWatch Logs Insights.
   • DAnalyze the logs by using Amazon QuickSight. Search the logs by listing the query results in a dashboard. Run queries to match logs with detection rules and to send alerts to the SNS topic

   Show answer

   Answer: A

   Next question

9. Question 79 · 79 in bank

   A company purchased a third-party managed rule group from AWS Marketplace to use with AWS WAF. The company uses AWS Organizations to manage multiple AWS accounts in a single organization. Application Load Balancers (ALBs) are present in multiple accounts and multiple AWS Regions. The company needs a solution to ensure that the rule group is used with every web ACL that is attached to every ALB. Which solution will meet this requirement with the LEAST operational overhead?

   • ACreate an AWS CloudFormation template. Deploy the template as a stack set in the management account. Configure the template to add the third-party managed rule group to each web ACL in each account and Region.
   • BConfigure an SCP to insert the AWS WAF rule group ARN in every new or existing web ACL in each account and Region.
   • CCreate an AWS WAF policy in AWS Firewall Manager. Specify the third-party managed rule group. Set the scope of the policy to all accounts and Regions.
   • DEnable AWS Security Hub CSPM in the organization. Configure Security Hub CSPM to automatically generate a finding if the third-party managed rule group is missing from any web ACL.

   Show answer

   Answer: C

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SCS-C03 practice, question 71. 79 questions available.