SCS-C03 Practice Questions

A.  

Grant access to the EC2 serial console at the account level.

B.  

Enable EC2 Instance Connect and configure security group rules.

C.  

Assign an EC2 instance role that allows access to AWS Systems Manager. Create an IAM policy that grants access to Systems Manager Session Manager. Assign the policy to an IAM role of the DevOps team.

D.  

Use AWS Systems Manager Automation runbooks to open remote access ports.

A.  

Use a dynamic reference in the CloudFormation template to reference the database credentials in Secrets Manager.

B.  

Use a parameter in the CloudFormation template to reference the database credentials. Encrypt the CloudFormation template by using AWS KMS.

C.  

Use a SecureString parameter in the CloudFormation template to reference the database credentials in Secrets Manager.

D.  

Use a SecureString parameter in the CloudFormation template to reference an encrypted value in AWS KMS.

A.  

Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application.

B.  

Enable Amazon Cognito and create a new identity pool for Amazon Q Developer.

C.  

Enable Amazon Cognito and set up Amazon Q Developer as an AWS managed application.

D.  

Enable AWS IAM Identity Center and create a new identity pool for Amazon Q Developer.

A.  

Revoke the temporary session that is associated with the instance profile that is attached to the EC2 instance.

B.  

Quarantine the EC2 instance by replacing the existing security group with a new security group that has no rules applied.

C.  

Enable Amazon Macie on the S3 bucket. Configure the managed data identifiers for personally identifiable information (PII). Enable S3 Object Lock on objects that Macie flags.

D.  

Apply an S3 bucket policy temporarily. Configure the policy to deny read access for all principals to block downloads while the development team address the vulnerability.

A.  

Create an AWS Config managed rule to detect unencrypted RDS storage. Configure an automatic remediation action to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.

B.  

Create an AWS Config managed rule to detect unencrypted RDS storage. Configure a manual remediation action to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.

C.  

Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource.

D.  

Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to invoke an AWS Lambda function. Configure the Lambda function to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic and to delete the unencrypted resource.

A.  

Enable ECR enhanced scanning with Lambda blocking.

B.  

Use Amazon Inspector with EventBridge and Lambda.

C.  

Integrate Amazon Inspector into the CI/CD pipeline using SBOM generation and fail the pipeline on critical findings.

D.  

Enable basic continuous ECR scanning.

A.  

Use AWS WAF to implement a rate-based rule for all incoming requests.

B.  

Use AWS WAF to implement a geographical match rule to block all incoming traffic from the two countries.

C.  

Edit the ALB security group to include a geographical match rule to block all incoming traffic from the two countries.

D.  

Add deny rules to the ALB security group that prohibit incoming requests from the IP addresses.

A.  

Create an AWS WAF web ACL with an IP match condition to deny the countries' IP ranges. Associate the web ACL with the CloudFront distribution.

B.  

Create an AWS WAF web ACL with a geo match condition to deny the specific countries. Associate the web ACL with the CloudFront distribution.

C.  

Use the geo restriction feature in CloudFront to deny the specific countries.

D.  

Use geolocation headers in CloudFront to deny the specific countries.

A.  

Create security groups that only accept inbound traffic from the CIDR blocks of all the VPCs in the organization. Attach the security groups to all the SQS queues in all the VPCs in the organization.

B.  

In all the VPCs in the organization, adjust the network ACLs to only accept inbound traffic from the CIDR blocks of all the VPCs in the organization. Attach the network ACLs to all the subnets in all the VPCs in the organization.

C.  

Create interface VPC endpoints for Amazon SQS in all the VPCs in the organization. Set the aws:SourceVpce condition to the VPC endpoint identifier on the SQS policy. Add the aws:PrincipalOrgId condition to the VPC endpoint policy.

D.  

Use a cloud access security broker (CASB) to maintain a list of managed resources. Configure the CASB to check the API and console access against that list on a web proxy.

A.  

Store the customer managed key in AWS Secrets Manager in us-west-1.

B.  

Create a new customer managed key in us-west-1 and use it to encrypt the snapshot.

C.  

Create an IAM policy to allow access to the key in us-east-1 from us-west-1.

D.  

Create an IAM policy that allows RDS in us-west-1 to access the key in us-east-1.