🔍

SCS-C02 — questions

Page 11 of 16 · 307 total questions.

SCS-C02 Question 201

Single page →
Topic 1 · Question 201

A security analyst attempted to troubleshoot the monitoring of suspicious security group changes. The analyst was told that there is an Amazon CloudWatch alarm in place for these AWS CloudTrail log events. The analyst tested the monitoring setup by making a configuration change to the security group but did not receive any alerts. Which of the following troubleshooting steps should the analyst perform?

  • AEnsure that CloudTrail and S3 bucket access logging is enabled for the analyst's AWS account.
  • BVerify that a metric filter was created and then mapped to an alarm. Check the alarm notification action. (correct answer)
  • CCheck the CloudWatch dashboards to ensure that there is a metric configured with an appropriate dimension for security group changes.
  • DVerify that the analyst's account is mapped to an IAM policy that includes permissions for cloudwatch:GetMetricStatistics and cloudwatch:ListMetrics.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Verify that a metric filter was created and then mapped to an alarm. Check the alarm notification action.

SCS-C02 Question 202

Single page →
Topic 1 · Question 202

An Amazon API Gateway API invokes an AWS Lambda function that needs to interact with a software-as-a-service (SaaS) platform. A unique client token is generated in the SaaS platform to grant access to the Lambda function. A security engineer needs to design a solution to encrypt the access token at rest and pass the token to the Lambda function at runtime. Which solution will meet these requirements MOST cost-effectively?

  • AStore the client token as a secret in AWS Secrets Manager. Use the AWS SDK to retrieve the secret in the Lambda function.
  • BConfigure a token-based Lambda authorizer in API Gateway.
  • CStore the client token as a SecureString parameter in AWS Systems Manager Parameter Store. Use the AWS SDK to retrieve the value of the SecureString parameter in the Lambda function. (correct answer)
  • DUse AWS Key Management Service (AWS KMS) to encrypt the client token. Pass the token to the Lambda function at runtime through an environment variable.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Store the client token as a SecureString parameter in AWS Systems Manager Parameter Store. Use the AWS SDK to retrieve the value of the SecureString parameter in the Lambda function.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Systems Manager Parameter Store securely stores configuration data and secrets. AWS Systems Manager operates and automates management of fleets of resources. This option delivers the requirement at the lowest cost.

SCS-C02 Question 203

Single page →
Topic 1 · Question 203

A company is using an Amazon CloudFront distribution to deliver content from two origins. One origin is a dynamic application that is hosted on Amazon EC2 instances. The other origin is an Amazon S3 bucket for static assets. A security analysis shows that HTTPS responses from the application do not comply with a security requirement to provide an X-Frame-Options HTTP header to prevent frame-related cross-site scripting attacks. A security engineer must make the full stack compliant by adding the missing HTTP header to the responses. Which solution will meet these requirements?

  • ACreate a Lambda@Edge function. Include code to add the X-Frame-Options header to the response. Configure the function to run in response to the CloudFront origin response event. (correct answer)
  • BCreate a Lambda@Edge function. Include code to add the X-Frame-Options header to the response. Configure the function to run in response to the CloudFront viewer request event.
  • CUpdate the CloudFront distribution by adding X-Frame-Options to custom headers in the origin settings.
  • DCustomize the EC2 hosted application to add the X-Frame-Options header to the responses that are returned to CloudFront.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a Lambda@Edge function. Include code to add the X-Frame-Options header to the response. Configure the function to run in response to the CloudFront origin response event.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon CloudFront caches content at edge locations to reduce latency and offload origins. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 204

Single page →
Topic 1 · Question 204 · Select all that apply

An application has been built with Amazon EC2 instances that retrieve messages from Amazon SQS. Recently, IAM changes were made and the instances can no longer retrieve messages. What actions should be taken to troubleshoot the issue while maintaining least privilege? (Choose two.)

  • AConfigure and assign an MFA device to the role used by the instances.
  • BVerify that the SQS resource policy does not explicitly deny access to the role used by the instances. (correct answer)
  • CVerify that the access key attached to the role used by the instances is active.
  • DAttach the AmazonSQSFullAccess managed policy to the role used by the instances.
  • EVerify that the role attached to the instances contains policies that allow access to the queue. (correct answer)
Reveal answer & explanation
Correct answer: B, E

The correct answer is B, E. Option B: Verify that the SQS resource policy does not explicitly deny access to the role used by the instances. Option E: Verify that the role attached to the instances contains policies that allow access to the queue.

Explanation

Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes.

SCS-C02 Question 205

Single page →
Topic 1 · Question 205

A company has an AWS Key Management Service (AWS KMS) customer managed key with imported key material. Company policy requires all encryption keys to be rotated every year. What should a security engineer do to meet this requirement for this customer managed key?

  • AEnable automatic key rotation annually for the existing customer managed key.
  • BUse the AWS CLI to create an AWS Lambda function to rotate the existing customer managed key annually.
  • CImport new key material to the existing customer managed key. Manually rotate the key.
  • DCreate a new customer managed key. Import new key material to the new key. Point the key alias to the new key. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a new customer managed key. Import new key material to the new key. Point the key alias to the new key.

SCS-C02 Question 206

Single page →
Topic 1 · Question 206

A healthcare company has multiple AWS accounts in an organization in AWS Organizations. The company uses Amazon S3 buckets to store sensitive information of patients. The company needs to restrict users from deleting any S3 bucket across the organization. What is the MOST scalable solution that meets these requirements?

  • APermissions boundaries in AWS Identity and Access Management (IAM)
  • BS3 bucket policies
  • CTag policies
  • DSCPs (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: SCPs

Explanation

Service Control Policies set guardrails on what accounts in an organization can do.

SCS-C02 Question 207

Single page →
Topic 1 · Question 207

A company needs to detect unauthenticated access to its Amazon Elastic Kubernetes Service (Amazon EKS) clusters. The company needs a solution that requires no additional configuration of the existing EKS deployment. Which solution will meet these requirements with the LEAST operational effort?

  • AInstall an Amazon EKS add-on from a security vendor.
  • BEnable AWS Security Hub. Monitor the Kubernetes findings.
  • CMonitor Amazon CloudWatch Container Insights metrics for Amazon EKS.
  • DEnable Amazon GuardDuty. Use EKS Audit Log Monitoring. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable Amazon GuardDuty. Use EKS Audit Log Monitoring.

Explanation

Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem. Amazon GuardDuty continuously monitors for threats and malicious activity.

SCS-C02 Question 208

Single page →
Topic 1 · Question 208

A security engineer is investigating a malware infection that has spread across a set of Amazon EC2 instances. A key indicator of the compromise is outbound traffic on TCP port 2905 to a set of command and control hosts on the internet. The security engineer creates a network ACL rule that denies the identified outbound traffic. The security engineer applies the network ACL rule to the subnet of the EC2 instances. The security engineer must identify any EC2 instances that are trying to communicate on TCP port 2905. Which solution will identify the affected EC2 instances with the LEAST operational effort?

  • ACreate a Network Access Scope in Amazon VPC Network Access Analyzer. Use the Network Access Scope to identify EC2 instances that try to send traffic to TCP port 2905.
  • BEnable VPC flow logs for the VPC where the affected EC2 instances are located. Configure the flow logs to capture rejected traffic. In the flow logs, search for REJECT records that have a destination TCP port of 2905. (correct answer)
  • CEnable Amazon GuardDuty. Create a custom GuardDuty IP list to create a finding when an EC2 instance tries to communicate with one of the command and control hosts. Use Amazon Detective to identify the EC2 instances that initiate the communication.
  • DCreate a firewall in AWS Network Firewall. Attach the firewall to the subnet of the EC2 instances. Create a custom rule to identify and log traffic from the firewall on TCP port 2905. Create an Amazon CloudWatch Logs metric filter to identify firewall logs that reference traffic on TCP port 2905.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable VPC flow logs for the VPC where the affected EC2 instances are located. Configure the flow logs to capture rejected traffic. In the flow logs, search for REJECT records that have a destination TCP port of 2905.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon RDS is a managed relational database that handles patching, backups and failover. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 209

Single page →
Topic 1 · Question 209

A security engineer uses Amazon Macie to scan a company’s Amazon S3 buckets for sensitive data. The company has many S3 buckets and many objects stored in the S3 buckets. The security engineer must identify S3 buckets that contain sensitive data and must perform additional scanning on those S3 buckets. Which solution will meet these requirements with the LEAST administrative overhead?

  • AConfigure S3 Cross-Region Replication (CRR) on the S3 buckets to replicate the objects to a second AWS Region. Configure Macie in the second Region to scan the replicated objects daily.
  • BCreate an AWS Lambda function as an S3 event destination for the S3 buckets. Configure the Lambda function to start a Macie scan of an object when the object is uploaded to an S3 bucket.
  • CConfigure Macie automated discovery to continuously sample data from the S3 buckets. Perform full scans of the S3 buckets where Macie discovers sensitive data. (correct answer)
  • DConfigure Macie scans to run on the S3 buckets. Aggregate the results of the scans in an Amazon DynamoDB table. Use the DynamoDB table for queries.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure Macie automated discovery to continuously sample data from the S3 buckets. Perform full scans of the S3 buckets where Macie discovers sensitive data.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Macie discovers and protects sensitive data such as PII in S3. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 210

Single page →
Topic 1 · Question 210

A security engineer for a large company is managing a data processing application used by 1,500 subsidiary companies. The parent and subsidiary companies all use AWS. The application uses TCP port 443 and runs on Amazon C2 behind a Network Load Balancer (NLB). For compliance reasons, the application should only be accessible to the subsidiaries and should not be available on the public internet. To meet the compliance requirements for restricted access, the engineer has received the public and private CIDR block ranges for each subsidiary. What solution should the engineer use to implement the appropriate access restrictions for the application?

  • ACreate a NACL to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the NACL to both the NLB and EC2 instances.
  • BCreate an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the security group to the NLCreate a second security group for EC2 instances with access on TCP port 443 from the NLB security group.
  • CCreate an AWS PrivateLink endpoint service in the parent company account attached to the NLB. Create an AWS security group for the instances to allow access on TCP port 443 from the AWS PrivateLink endpoint. Use AWS PrivateLink interface endpoints in the 1,500 subsidiary AWS accounts to connect to the data processing application. (correct answer)
  • DCreate an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR block ranges. Associate the security group with EC2 instances.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an AWS PrivateLink endpoint service in the parent company account attached to the NLB. Create an AWS security group for the instances to allow access on TCP port 443 from the AWS PrivateLink endpoint. Use AWS P...

Explanation

AWS PrivateLink exposes services privately inside the VPC without internet exposure.

SCS-C02 Question 211

Single page →
Topic 1 · Question 211

A company runs workloads on Amazon EC2 instances. The company needs to continually scan the EC2 instances for software vulnerabilities and unintended network exposure. Which solution will meet these requirements?

  • AUse Amazon Inspector. Set the scan mode to hybrid scanning. (correct answer)
  • BUse Amazon GuardDuty. Enable the Malware Protection feature.
  • CUse Amazon Inspector. Enable the Malware Protection feature.
  • DUse Amazon GuardDuty. Enable the Runtime Monitoring feature.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use Amazon Inspector. Set the scan mode to hybrid scanning.

Explanation

Amazon Inspector automatically scans workloads for software vulnerabilities.

SCS-C02 Question 212

Single page →
Topic 1 · Question 212

A company has a requirement that no Amazon EC2 security group can allow SSH access from the CIDR block 0.0.0.0/0. The company wants to monitor compliance with this requirement at all times and wants to receive a near-real-time notification if any security group is noncompliant. A security engineer has configured AWS Config and will use the restricted-ssh managed rule to monitor the security groups. What should the security engineer do next to meet these requirements?

  • AConfigure AWS Config to send its configuration snapshots to an Amazon S3 bucket. Create an AWS Lambda function to run on a PutEvent to the S3 bucket. Configure the Lambda function to parse the snapshot for a compliance change to the restricted-ssh managed rule. Configure the Lambda function to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if a change is discovered.
  • BConfigure an Amazon EventBridge event rule that is invoked by a compliance change event from AWS Config for the restricted-ssh managed rule. Configure the event rule to target an Amazon Simple Notification Service (Amazon SNS) topic that will provide a notification. (correct answer)
  • CConfigure AWS Config to push all its compliance notifications to Amazon CloudWatch Logs. Configure a CloudWatch Logs metric filter on the AWS Config log group to look for a compliance notification change on the restricted-ssh managed rule. Create an Amazon CloudWatch alarm on the metric filter to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if the alarm is in the ALARM state.
  • DConfigure an Amazon CloudWatch alarm on the CloudWatch metric for the restricted-ssh managed rule. Configure the CloudWatch alarm to send a notification to an Amazon Simple Notification Service (Amazon SNS) topic if the alarm is in the ALARM state.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure an Amazon EventBridge event rule that is invoked by a compliance change event from AWS Config for the restricted-ssh managed rule. Configure the event rule to target an Amazon Simple Notification Service (Am...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Config tracks resource configuration changes and evaluates compliance. This option meets the real-time / low-latency performance requirement.

SCS-C02 Question 213

Single page →
Topic 1 · Question 213 · Select all that apply

A security engineer discovers that a company’s user passwords have no required minimum length. The company is using the following two identity providers (IdPs): • AWS Identity and Access Management (IAM) federated with on-premises Active Directory • Amazon Cognito user pools that contain the user database for an AWS Cloud application that the company developed Which combination of actions should the security engineer take to implement a required minimum length for the passwords? (Choose two.)

  • AUpdate the password length policy in the IAM configuration.
  • BUpdate the password length policy in the Cognito configuration. (correct answer)
  • CUpdate the password length policy in the on-premises Active Directory configuration (correct answer)
  • DCreate an SCP in AWS Organizations. Configure the SCP to enforce a minimum password length for IAM and Cognito.
  • ECreate an IAM policy that includes a condition for minimum password length. Enforce the policy for IAM and Cognito.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: Update the password length policy in the Cognito configuration. Option C: Update the password length policy in the on-premises Active Directory configuration

Explanation

Amazon Cognito manages user sign-up, sign-in and federated identity for applications. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 214

Single page →
Topic 1 · Question 214

A company uses AWS Key Management Service (AWS KMS). During an attempt to attach an encrypted Amazon Elastic Block Store (Amazon EBS) volume to an Amazon EC2 instance, the attachment fails. The company discovers that a customer managed key has become unusable because the key material for the key was deleted. The company needs the data that is on the EBS volume. A security engineer must recommend a solution to decrypt the EBS volume’s encrypted data key. The solution must also attach the volume to the EC2 instance. Which solution will meet these requirements?

  • AImport new key material into the key. Attach the EBS volume.
  • BRestore the EBS volume from a snapshot that was taken before the deletion of the key material.
  • CReimport the same key material that originally was imported into the key. Attach the EBS volume. (correct answer)
  • DCreate a new key. Import new key material. Attach the EBS volume.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Reimport the same key material that originally was imported into the key. Attach the EBS volume.

Explanation

Amazon EBS provides block storage attached to a single EC2 instance.

SCS-C02 Question 215

Single page →
Topic 1 · Question 215

A company needs to analyze access logs for an Application Load Balancer (ALB). The ALB directs traffic to the company’s online login portal. The company needs to use visualizations to identify login attempts by bots from a list of known IP sources. Which solution will meet these requirements?

  • AConfigure the ALB to send logs directly to Amazon CloudWatch Logs. Analyze and visualize the logs by using CloudWatch Logs Insights.
  • BConfigure the ALB to send logs directly to Amazon Redshift. Analyze the logs by using SQL queries. Visualize the logs by using custom reports.
  • CConfigure the ALB to send logs directly to Amazon OpenSearch Service. Analyze the logs by using OpenSearch dashboards. Visualize the logs by using custom OpenSearch dashboards.
  • DConfigure the ALB to send logs directly to an Amazon S3 bucket. Analyze the logs by using Amazon Athena. Visualize the logs by using Amazon QuickSight. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure the ALB to send logs directly to an Amazon S3 bucket. Analyze the logs by using Amazon Athena. Visualize the logs by using Amazon QuickSight.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Athena runs serverless SQL queries directly on data in Amazon S3 with no infrastructure to manage. Amazon QuickSight is a serverless business-intelligence and dashboard service.

SCS-C02 Question 216

Single page →
Topic 1 · Question 216

A company runs a cron job on an Amazon EC2 instance on a predefined schedule. The cron job calls a bash script that encrypts a 2 KB file. A security engineer creates an AWS Key Management Service (AWS KMS) customer managed key with a key policy. The key policy and the EC2 instance role have the necessary configuration for this job. Which process should the bash script use to encrypt the file?

  • AUse the aws kms encrypt command to encrypt the file by using the existing KMS key. (correct answer)
  • BUse the aws kms create-grant command to generate a grant for the existing KMS key.
  • CUse the aws kms encrypt command to generate a data key. Use the plaintext data key to encrypt the file.
  • DUse the aws kms generate-data-key command to generate a data key. Use the encrypted data key to encrypt the file.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use the aws kms encrypt command to encrypt the file by using the existing KMS key.

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SCS-C02 Question 217

Single page →
Topic 1 · Question 217

A security engineer needs to analyze Apache web server access logs that are stored in an Amazon S3 bucket. Amazon EC2 instance web servers generated the logs. The EC2 instances have the Amazon CloudWatch agent installed and configured to report their access logs. The security engineer needs to use a query in Amazon Athena to analyze the logs. The query must identify IP addresses that have attempted and failed to access restricted web server content held at the /admin URL path. The query also must identify the URLs that the IP addresses attempted to access. Which query will meet these requirements?

  • ASELECT client_ip, client_request FROM logs WHERE client_request LIKE '%/admin%!’ AND server_status = '403’ (correct answer)
  • BSELECT client_ip FROM logs WHERE client_request CONTAINS '%/admin%’ AND server_status = '401' GROUP BY client_ip
  • CSELECT DISTINCT (client_ip), client_request, client_id FROM logs WHERE server status = ‘403’ LIMIT 1000
  • DSELECT DISTINCT (client_ip), client_request FROM logs WHERE user_id <> ‘admin’ AND server_status = ‘401!’
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: SELECT client_ip, client_request FROM logs WHERE client_request LIKE '%/admin%!’ AND server_status = '403’.

SCS-C02 Question 218

Single page →
Topic 1 · Question 218

A company uses Amazon Cognito as an OAuth 2.0 identity platform for its web and mobile applications. The company needs to capture successful and unsuccessful login attempts. The company also needs to query the data about the login attempts. Which solution will meet these requirements?

  • AConfigure Cognito to send logs of user activity to Amazon CloudWatch. Configure Amazon EventBridge to invoke an AWS Lambda function to export the logs to an Amazon S3 bucket. Use Amazon Athena to query the logs for event names of SignUp with event sources of cognito-idp.amazonaws.com.
  • BEnable AWS CloudTrail to deliver logs to an Amazon S3 bucket. Use Amazon Athena to query the logs for event names of InitiateAuth with event sources of cognito-idp.amazonaws.com. (correct answer)
  • CConfigure AWS CloudTrail to send Cognito CloudTrail events to Amazon CloudWatch for monitoring. Query the event logs for event names of SignUp with event sources of cognito-idp.amazonaws.com.
  • DConfigure Amazon CloudWatch metrics to monitor and report Cognito events. Create a CloudWatch dashboard for the provided metrics. Display the Cognito user pools for event names of InitiateAuth with event sources of cognito-idp.amazonaws.com.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable AWS CloudTrail to deliver logs to an Amazon S3 bucket. Use Amazon Athena to query the logs for event names of InitiateAuth with event sources of cognito-idp.amazonaws.com.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon Athena runs serverless SQL queries directly on data in Amazon S3 with no infrastructure to manage. Amazon Cognito manages user sign-up, sign-in and federated identity for applications.

SCS-C02 Question 219

Single page →
Topic 1 · Question 219

A security engineer is setting up an AWS CloudTrail trail for all regions in an AWS account. For added security, the logs are stored using server-side encryption with AWS KMS-managed keys (SSE-KMS) and have log integrity validation enabled. While testing the solution, the security engineer discovers that the digest files are readable, but the log files are not. What is the MOST likely cause?

  • AThe log files fail integrity validation and automatically are marked as unavailable.
  • BThe KMS key policy does not grant the security engineer’s IAM user or role permissions to decrypt with it. (correct answer)
  • CThe bucket is set up to use server-side encryption with Amazon S3-managed keys (SSE-S3) as the default and does not allow SSE-KMS-encrypted files.
  • DAn IAM policy applicable to the security engineer’s IAM user or role denies access to the “CloudTrail/” prefix in the Amazon S3 bucket.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: The KMS key policy does not grant the security engineer’s IAM user or role permissions to decrypt with it.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SCS-C02 Question 220

Single page →
Topic 1 · Question 220

A company needs to securely deploy resources and workloads across AWS accounts. The accounts are in an organization in AWS Organizations. The company needs to use AWS CloudFormation for infrastructure as code (IaC) management of approved architectural patterns. The company also must enforce tagging requirements and specific guidelines for resource and workload configuration and creation. Which solution will meet these requirements?

  • AUse CloudFormation stack policies to prevent the creation of resources that do not meet the tagging or configuration requirements. Use Amazon EventBridge rules to detect API calls that attempt to create resources outside of CloudFormation.
  • BUse an AWS CodePipeline pipeline to test and deploy IaC defined workloads through CloudFormation into the accounts. Use AWS Config rules to enforce the tagging requirements. Apply an SCP to prevent the creation of misconfigured resources in all OUs.
  • CCreate an IAM permissions boundary to prevent the creation of misconfigured resources through CloudFormation and to enforce the tagging requirements. Apply the permissions boundary to all account roles. Use AWS Config rules to identify existing resources that are in a misconfigured state.
  • DUse AWS Service Catalog with CloudFormation to manage access to approved architecture configurations. Provision Service Catalog portfolios to the accounts across the organization. Use AWS Config rules to enforce the tagging requirements and other resource configuration policies across accounts. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS Service Catalog with CloudFormation to manage access to approved architecture configurations. Provision Service Catalog portfolios to the accounts across the organization. Use AWS Config rules to enforce the t...

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS CloudFormation provisions infrastructure as code repeatably.

Showing questions 201–220 of 307 · Page 11 of 16