SCS-C03 Practice Questions

A.  

Use Amazon Cognito identity pools and the GetId API.

B.  

Use Amazon Cognito identity pools and AssumeRoleWithWebIdentity.

C.  

Use Amazon Cognito user pools with ID tokens.

D.  

Use Amazon Cognito user pools with access tokens.

A.  

Use AWS Audit Manager with a custom framework.

B.  

Enable AWS Config and use managed rules to monitor Aurora MySQL compliance.

C.  

Use AWS Security Hub configuration policies.

D.  

Use EventBridge and Lambda with custom metrics.

A.  

Disable the EC2 instance profile credentials by using AWS Lambda.

B.  

Create an Amazon EventBridge rule that invokes an AWS Lambda function when GuardDuty detects anomalous traffic. Configure the function to remove the affected instance from the Auto Scaling group and attach a restricted security group.

C.  

Update the subnet network ACL to block traffic from the detected source IP addresses.

D.  

Send GuardDuty findings to Amazon SNS for email notification.

A.  

Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.

B.  

Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.

C.  

Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.

D.  

Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.

A.  

Use AWS Resource Access Manager (AWS RAM) to share the VPC subnet ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.

B.  

Use AWS Identity and Access Management (IAM) to create a cross-account role to access the CloudHSM cluster that is in the central account. Create a new IAM user in the new dedicated account. Assign the cross-account role to the new IAM user.

C.  

Use AWS IAM Identity Center to create an AWS Security Token Service (AWS STS) token to authenticate from the new dedicated account to the central account. Use the cross-account permissions that are assigned to the STS token to invoke an operation on the HSM in the central account.

D.  

Use AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.

A.  

Call the abort-vault-lock operation. Update the policy. Call the initiate-vault-lock operation again.

B.  

Copy the vault data to a new S3 bucket. Delete the vault. Create a new vault with the data.

C.  

Update the policy to keep the vault lock in place.

D.  

Update the policy. Call the initiate-vault-lock operation again to apply the new policy.

A.  

Enable Amazon Cognito threat protection.

B.  

Restrict access to authenticated users only.

C.  

Associate AWS WAF with the Cognito user pool.

D.  

Monitor requests with CloudWatch.

A.  

Make the following changes to NACL3:

• Add a rule that allows inbound traffic on port 5432 from NACL2.

• Add a rule that allows outbound traffic on ports 1024-65536 to NACL2.

• Remove the default rules that allow all inbound and outbound traffic.

B.  

Make the following changes to NACL3:

• Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the application instance subnets.

• Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets.

• Remove the default rules that allow all inbound and outbound traffic.

C.  

Make the following changes to NACL2:

• Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDS subnets.

• Remove the default rules that allow all inbound and outbound traffic.

D.  

Make the following changes to NACL2:

• Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDS subnets.

• Add a rule that allows outbound traffic on port 5432 to the RDS subnets.

A.  

Add theaws:sourceVpcecondition to the AWS KMS key policy referencing the company ' s VPC endpoint I

D.  

B.  

Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.

C.  

Create a VPC endpoint for AWS KMS withprivate DNS enabled.

D.  

Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.

E.  

Add the following condition to the AWS KMS key policy: " aws:SourceIp " : " 10.0.0.0/16 " .

A.  

Use Amazon Detective to run investigations on the IAM roles and to visualize the findings.

B.  

Use Amazon Inspector to run investigations on the IAM roles and visualize the findings.

C.  

Export GuardDuty findings to Amazon S3 and analyze them with Amazon Athena.

D.  

Enable AWS Security Hub and use custom actions to investigate IAM roles.