SCS-C02 — questions

Page 13 of 16 · 307 total questions.

SCS-C02 Question 241

Topic 1 · Question 241 · Select all that apply

An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connect to the website during the attack period. The ecommerce company’s security team is worried about future potential attacks and wants to prepare for such events. The company needs to minimize downtime in its response to similar attacks in the future. Which steps would help achieve this? (Choose two.)

AEnable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
BSubscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack. (correct answer)
CUse VPC Flow Logs to monitor network traffic and an AWS Lambda function to automatically block an attacker’s IP using security groups.
DSet up an Amazon EventBridge rule to monitor the AWS CloudTrail events in real time, use AWS Config rules to audit the configuration, and use AWS Systems Manager for remediation.
EUse AWS WAF to create rules to respond to such attacks. (correct answer)

Reveal answer & explanation

Correct answer: B, E

The correct answer is B, E. Option B: Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack. Option E: Use AWS WAF to create rules to respond to such attacks.

Explanation

AWS WAF protects web applications from common exploits and malicious requests. AWS Shield provides managed DDoS protection.

SCS-C02 Question 242

Single page →

Topic 1 · Question 242

An AWS account includes two S3 buckets: bucket1 and bucket2. The bucket2 does not have a policy defined, but bucket1 has the following bucket policy: In addition, the same account has an IAM User named “alice”, with the following IAM policy. Which buckets can user “alice” access?

Abucket1 only
Bbucket2 only
CBoth bucket1 and bucket2 (correct answer)
DNeither bucket1 nor bucket2

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Both bucket1 and bucket2.

SCS-C02 Question 243

Single page →

Topic 1 · Question 243

A company plans to create Amazon S3 buckets to store log data. All the S3 buckets will have versioning enabled and will use the S3 Standard storage class. A security engineer needs to implement a solution that protects objects in the S3 buckets from deletion for 90 days. The solution must ensure that no object can be deleted during this time period, even by an administrator or the AWS account root user. Which solution will meet these requirements?

AEnable S3 Object Lock in governance mode. Set a legal hold of 90 days.
BEnable S3 Object Lock in governance mode. Set a retention period of 90 days.
CEnable S3 Object Lock in compliance mode. Set a retention period of 90 days. (correct answer)
DCreate an S3 Glacier Vault Lock policy that prevents deletion for 90 days.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Enable S3 Object Lock in compliance mode. Set a retention period of 90 days.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SCS-C02 Question 244

Single page →

Topic 1 · Question 244

A company has used AWS Lambda functions to build an application on AWS. The company’s security engineer implemented Amazon Inspector and activated Lambda standard scanning and Lambda code scanning. The security engineer reviews the Amazon Inspector console and learns that Amazon Inspector is not scanning some of the Lambda functions. The provided reason is that the scan eligibility expired. What should the security engineer do to investigate the reason that the scans are failing?

AValidate that the AmazonInspector2ServiceRolePolicy AWS managed policy grants permissions to access Lambda.
BIncrease the timeout value of the Lambda functions to complete the scans successfully while the code is running.
CBuild a custom runtime for the unscanned Lambda functions. Include the Amazon Inspector agent in the runtime.
DDetermine whether the unscanned Lambda functions have been invoked in the last 90 days. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Determine whether the unscanned Lambda functions have been invoked in the last 90 days.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead.

SCS-C02 Question 245

Single page →

Topic 1 · Question 245

A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company’s primary website. The GuardDuty finding received read: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration. The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor. What is the first step the security engineer should take?

AOpen the EC2 console and remove any security groups that allow inbound traffic from 0.0.0.0/0.
BInstall the AWS Systems Manager Agent on the EC2 instance and run an inventory report.
CInstall the Amazon Inspector agent on the host and run an assessment with the CVE rules package.
DOpen the IAM console and revoke all IAM sessions that are associated with the instance profile. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Open the IAM console and revoke all IAM sessions that are associated with the instance profile.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SCS-C02 Question 246

Single page →

Topic 1 · Question 246

A company is testing incident response procedures for destination containment. The company needs to contain a critical Amazon EC2 instance as quickly as possible while keeping the EC2 instance running. The EC2 instance is the only resource in a public subnet and has active connections to other resources. Which solution will contain the EC2 instance IMMEDIATELY?

ACreate a new security group that has no inbound rules or outbound rules. Attach the new security group to the EC2 instance.
BConfigure the existing security group for the EC2 instance. Remove all existing inbound rules and outbound rules from the security group.
CCreate a new network ACL that has a single Deny rule for inbound traffic and outbound traffic. Associate the new network ACL with the subnet that contains the EC2 instance. (correct answer)
DCreate a new VPC for isolation. Stop the EC2 instance. Create a new AMI from the EC2 instance. Use the new AMI to launch a new EC2 instance in the new VPC.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create a new network ACL that has a single Deny rule for inbound traffic and outbound traffic. Associate the new network ACL with the subnet that contains the EC2 instance.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SCS-C02 Question 247

Single page →

Topic 1 · Question 247

A company needs to use HTTPS when connecting to its web applications to meet compliance requirements. These web applications run in Amazon VPC on Amazon EC2 instances behind an Application Load Balancer (ALB). A security engineer wants to ensure that the load balancer will only accept connections over port 443, even if the ALB is mistakenly configured with an HTTP listener. Which configuration steps should the security engineer take to accomplish this task?

ACreate a security group with a rule that denies inbound connections from 0.0.0.0/0 on port 80. Attach this security group to the ALB to overwrite more permissive rules from the ALB’s default security group.
BCreate a network ACL that denies inbound connections from 0.0.0.0/0 on port 80. Associate the network ACL with the VPC’s internet gateway.
CCreate a network ACL that allows outbound connections to the VPC IP range on port 443 only. Associate the network ACL with the VPC’s internet gateway.
DCreate a security group with a single inbound rule that allows connections from 0.0.0.0/0 on port 443. Ensure this security group is the only one associated with the ALB. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Create a security group with a single inbound rule that allows connections from 0.0.0.0/0 on port 443. Ensure this security group is the only one associated with the ALB.

SCS-C02 Question 248

Single page →

Topic 1 · Question 248

A consultant agency needs to perform a security audit for a company’s production AWS account. Several consultants need access to the account. The consultant agency already has its own AWS account. The company requires multi-factor authentication (MFA) for all access to its production account. The company also forbids the use of long-term credentials. Which solution will provide the consultant agency with access that meets these requirements?

ACreate an IAM group. Create an IAM user for each consultant. Add each user to the group. Turn on MFA for each consultant.
BConfigure Amazon Cognito on the company’s production account to authenticate against the consultant agency’s identity provider (IdP). Add MFA to a Cognito user pool.
CCreate an IAM role in the consultant agency’s AWS account. Define a trust policy that requires MFA. In the trust policy, specify the company’s production account as the principal. Attach the trust policy to the role.
DCreate an IAM role in the company’s production account. Define a trust policy that requires MFA. In the trust policy, specify the consultant agency’s AWS account as the principal. Attach the trust policy to the role. (correct answer)

Reveal answer & explanation

Correct answer: D

The correct answer is D. Option D: Create an IAM role in the company’s production account. Define a trust policy that requires MFA. In the trust policy, specify the consultant agency’s AWS account as the principal. Attach the trust policy to the role.

Explanation

An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SCS-C02 Question 249

Single page →

Topic 1 · Question 249 · Select all that apply

A company uses AWS Lambda functions to implement application logic. The company uses an organization in AWS Organizations to manage hundreds of AWS accounts. The company needs to implement a solution to continuously monitor the Lambda functions for vulnerabilities in all accounts. The solution must publish detected issues to a dashboard. Lambda functions that are being tested or are in development must not appear on the dashboard. Which combination of steps will meet these requirements? (Choose two.)

ADesignate a delegated Amazon GuardDuty administrator account in the organization’s management account. Use the GuardDuty Summary dashboard to obtain an overview of Lambda functions that have vulnerabilities.
BDesignate a delegated Amazon Inspector administrator account in the organization’s management account. Use the Amazon Inspector dashboard to obtain an overview of Lambda functions that have vulnerabilities. (correct answer)
CApply tags of “test” or “development” to all Lambda functions that are in testing or development. Use a suppression filter that suppresses findings that contain these tags. (correct answer)
DEnable AWS Shield Advanced in the organization’s management account. Use Amazon CloudWatch to build a dashboard for Lambda functions that have vulnerabilities.
EEnable Lambda Protection in GuardDuty for all accounts. Auto-enable Lambda Protection for new accounts. Apply a tag to the Lambda functions that are in testing or development. Use GuardDutyExclusion as the tag key and LambdaStandardScanning as the tag value.

Reveal answer & explanation

Correct answer: B, C

The correct answer is B, C. Option B: Designate a delegated Amazon Inspector administrator account in the organization’s management account. Use the Amazon Inspector dashboard to obtain an overview of Lambda functions that have vulnerabilities. Option C: Apply tags of “test” or “development” to all Lambda functions that are in testing or development. Use a suppression filter that suppresses findings that contain these tags.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon Inspector automatically scans workloads for software vulnerabilities.

SCS-C02 Question 250

Single page →

Topic 1 · Question 250

A company has an organization in AWS Organizations that includes dedicated accounts for each of its business units. The company is collecting all AWS CloudTrail logs from the accounts in a single Amazon S3 bucket in the top-level account. The company’s IT governance team has access to the top-level account. A security engineer needs to allow each business unit to access its own CloudTrail logs. The security engineer creates an IAM role in the top-level account for each of the other accounts. For each role, the security engineer creates an IAM policy to allow read-only permissions to objects in the S3 bucket with the prefix of the respective logs. Which action must the security engineer take in each business unit account to allow an IAM user in that account to read the logs?

AAttach a policy to the IAM user to allow the user to assume the role that was created in the top-level account. Specify the role’s ARN in the policy. (correct answer)
BCreate an SCP that grants permissions to the top-level account.
CUse the root account of the business unit account to assume the role that was created in the top-level account. Specify the role’s ARN in the policy.
DForward the credentials of the IAM role in the top-level account to the IAM user in the business unit account.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Attach a policy to the IAM user to allow the user to assume the role that was created in the top-level account. Specify the role’s ARN in the policy.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

SCS-C02 Question 251

Single page →

Topic 1 · Question 251

A company has configured an organization in AWS Organizations for its AWS accounts. AWS CloudTrail is enabled in all AWS Regions. A security engineer must implement a solution to prevent CloudTrail from being disabled. Which solution will meet this requirement?

AEnable CloudTrail log file integrity validation from the organization’s management account.
BEnable server-side encryption with AWS KMS keys (SSE-KMS) for CloudTrail logs. Create a KMS key. Attach a policy to the key to prevent decryption of the logs.
CCreate an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail action. Attach the SCP to the root OU. (correct answer)
DCreate IAM policies for all the company’s users to prevent the users from performing the DescribeTrails action and the GetTrailStatus action.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Create an SCP that includes an explicit Deny rule for the StopLogging action and the DeleteTrail action. Attach the SCP to the root OU.

Explanation

Service Control Policies set guardrails on what accounts in an organization can do.

SCS-C02 Question 252

Single page →

Topic 1 · Question 252

A company runs its microservices architecture in Kubernetes containers on AWS by using Amazon Elastic Kubernetes Service (Amazon EKS) and Amazon Aurora The company has an organization in AWS Organizations to manage hundreds of AWS accounts that host different microservices. The company needs to implement a monitoring solution for logs from all AWS resources across all accounts. The solution must include automatic detection of security-related issues. Which solution will meet these requirements with the LEAST operational effort?

ADesignate an Amazon GuardDuty administrator account in the organization’s management account. Enable GuardDuty for all accounts. Enable EKS Protection and RDS Protection in the GuardDuty administrator account. (correct answer)
BDesignate a monitoring account. Share Amazon CloudWatch logs from all accounts with the monitoring account. Configure Aurora to publish all logs to CloudWatch. Use Amazon Inspector in the monitoring account to evaluate the CloudWatch logs.
CCreate a central Amazon S3 bucket in the organization’s management account. Configure AWS CloudTrail in all AWS accounts to deliver CloudTrail logs to the S3 bucket. Configure Aurora to publish all logs to CloudTrail. Use Amazon Athena to query the CloudTrail logs in the S3 bucket for security issues.
DDesignate a monitoring account. Share Amazon CloudWatch logs from all accounts with the monitoring account. Subscribe an Amazon Kinesis data stream to the CloudWatch logs. Create AWS Lambda functions to process log records in the data stream to detect security issues.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Designate an Amazon GuardDuty administrator account in the organization’s management account. Enable GuardDuty for all accounts. Enable EKS Protection and RDS Protection in the GuardDuty administrator account.

Explanation

Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem. Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon GuardDuty continuously monitors for threats and malicious activity.

SCS-C02 Question 253

Single page →

Topic 1 · Question 253 · Select all that apply

A security engineer has been asked to troubleshoot inbound connectivity to a web server. This single web server is not receiving inbound connections from the internet, whereas all other web servers are functioning properly. The architecture includes network ACLs, security groups, and a virtual security appliance. In addition, the development team has implemented Application Load Balancers (ALBs) to distribute the load across all web servers. It is a requirement that traffic between the web servers and the internet flow through the virtual security appliance. The security engineer has verified the following: 1. The rule set in the security groups is correct. 2. The rule set in the network ACLs is correct. 3. The rule set in the virtual appliance is correct. Which of the following are other valid items to troubleshoot in this scenario? (Choose two.)

AVerify that the 0.0.0.0/0 route in the route table for the web server subnet points to a NAT gateway.
BVerify which security group is applied to the particular web server’s elastic network interface (ENI). (correct answer)
CVerify that the 0.0.0.0/0 route in the route table for the web server subnet points to the virtual security appliance.
DVerify the registered targets in the ALB. (correct answer)
EVerify that the 0.0.0.0/0 route in the public subnet points to a NAT gateway.

Reveal answer & explanation

Correct answer: B, D

The correct answer is B, D. Option B: Verify which security group is applied to the particular web server’s elastic network interface (ENI). Option D: Verify the registered targets in the ALB.

SCS-C02 Question 254

Single page →

Topic 1 · Question 254

A company has a strict policy against using root credentials. The company’s security team wants to be alerted as soon as possible when root credentials are used to sign in to the AWS Management Console. How should the security team achieve this goal?

AUse AWS Lambda to periodically query AWS CloudTrail for console login events and send alerts using Amazon Simple Notification Service (Amazon SNS).
BUse Amazon EventBridge to monitor console logins and direct them to Amazon Simple Notification Service (Amazon SNS). (correct answer)
CUse Amazon Athena to query AWS IAM Identity Center logs and send alerts using Amazon Simple Notification Service (Amazon SNS) for root login events.
DConfigure AWS Resource Access Manager to review the access logs and send alerts using Amazon Simple Notification Service (Amazon SNS).

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Use Amazon EventBridge to monitor console logins and direct them to Amazon Simple Notification Service (Amazon SNS).

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

SCS-C02 Question 255

Single page →

Topic 1 · Question 255

A company wants to store all objects that contain sensitive data in an Amazon S3 bucket. The company will use server-side encryption to encrypt the S3 bucket. The company’s operations team manages access to the company’s S3 buckets. The company’s security team manages access to encryption keys. The company wants to separate the duties of the two teams to ensure that configuration errors by only one of these teams will not compromise the data by granting unauthorized access to plaintext data. Which solution will meet this requirement?

AEnsure that the operations team configures default bucket encryption on the S3 bucket to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to use the encryption keys.
BEnsure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed. Ensure that the security team creates a key policy that controls access to the encryption keys. (correct answer)
CEnsure that the operations team creates a bucket policy that requires requests to use server-side encryption with Amazon S3 managed keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to the encryption keys.
DEnsure that the operations team creates a bucket policy that requires requests to use server-side encryption with customer-provided encryption keys (SSE-C). Ensure that the security team stores the customer-provided keys in AWS Key Management Service (AWS KMS). Ensure that the security team creates a key policy that controls access to the encryption keys.

Reveal answer & explanation

Correct answer: B

The correct answer is B. Option B: Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed. Ensure that the security team creates a key policy th...

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SCS-C02 Question 256

Single page →

Topic 1 · Question 256

A security engineer is designing security controls for a fleet of Amazon EC2 instances that run sensitive workloads in a VPC. The security engineer needs to implement a solution to detect and mitigate software vulnerabilities on the EC2 instances. Which solution will meet this requirement?

AScan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager. (correct answer)
BInstall host-based firewall and antivirus software on each EC2 instance. Use AWS Systems Manager Run Command to update the firewall and antivirus software.
CInstall the Amazon CloudWatch agent on the EC2 instances. Enable detailed logging. Use Amazon EventBridge to review the software logs for anomalies.
DScan the EC2 instances by using Amazon GuardDuty Malware Protection. Apply security patches and updates by using AWS Systems Manager Patch Manager.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Scan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon Inspector automatically scans workloads for software vulnerabilities. AWS Systems Manager operates and automates management of fleets of resources.

SCS-C02 Question 257

Single page →

Topic 1 · Question 257

A company stores sensitive data in AWS Secrets Manager. A security engineer needs to design a solution to generate a notification email when anomalous GetSecretValue API calls occur. The security engineer has configured an Amazon EventBridge rule for all Secrets Manager events that AWS CloudTrail delivers. Which solution will meet these requirements?

AConfigure CloudTrail as the target of the EventBridge rule. Set up an attribute filter on the IncomingBytes attribute and enable anomaly detection. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure a CloudTrail alarm that uses the SNS topic to send the notification.
BConfigure CloudTrail as the target of the EventBridge rule. Set up an attribute filter on the IncomingBytes attribute and enable anomaly detection. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure a CloudTrail alarm that uses the SQS queue to send the notification.
CConfigure Amazon CloudWatch Logs as the target of the EventBridge rule. Set up a metric filter on the IncomingBytes metric and enable anomaly detection. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure a CloudWatch alarm that uses the SNS topic to send the notification. (correct answer)
DConfigure Amazon CloudWatch Logs as the target of the EventBridge rule. Use CloudWatch Logs Insights query syntax to search for anomalous GetSecretValue API calls. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure a CloudWatch alarm that uses the SQS queue to send the notification.

Reveal answer & explanation

Correct answer: C

The correct answer is C. Option C: Configure Amazon CloudWatch Logs as the target of the EventBridge rule. Set up a metric filter on the IncomingBytes metric and enable anomaly detection. Create an Amazon Simple Notification Service (Amazon SNS) topic....

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SCS-C02 Question 258

Single page →

Topic 1 · Question 258

A company is using AWS Organizations with the default SCP. The company needs to restrict AWS usage for all AWS accounts that are in a specific OU.

Except for some desired global services, the AWS usage must occur only in the eu-west-1 Region for all accounts in the OU. A security engineer must create an SCP that applies the restriction to existing accounts and any new accounts in the OU.

Which SCP will meet these requirements?

A
B
C (correct answer)
D

Reveal answer & explanation

Correct answer: C

The correct answer is C. Compare the policy/code shown in each option image.

SCS-C02 Question 259

Single page →

Topic 1 · Question 259 · Select all that apply

A company is planning to migrate its applications to AWS in a single AWS Region. The company’s applications will use a combination of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, and Amazon S3 buckets. The company wants to complete the migration as quickly as possible. All the applications must meet the following requirements: • Data must be encrypted at rest. • Data must be encrypted in transit. • Endpoints must be monitored for anomalous network traffic. Which combination of steps should a security engineer take to meet these requirements with the LEAST effort? (Choose three.)

AInstall the Amazon Inspector agent on EC2 instances by using AWS Systems Manager Automation.
BEnable Amazon GuardDuty in all AWS accounts. (correct answer)
CCreate VPC endpoints for Amazon EC2 and Amazon S3. Update VPC route tables to use only the secure VPC endpoints.
DConfigure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from ACM. (correct answer)
EUse AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-meta-side-encryption.
FUse AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-server-side-encryption. (correct answer)

Reveal answer & explanation

Correct answer: B, D, F

The correct answer is B, D, F. Option B: Enable Amazon GuardDuty in all AWS accounts. Option D: Configure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from ACM. Option F: Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket policy to deny any PutObject command with a condition for x-amz-server-side-encryption.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A load balancer distributes traffic across targets in multiple AZs for availability and scale. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

SCS-C02 Question 260

Single page →

Topic 1 · Question 260

A security engineer is working with a development team to design a supply chain application that stores sensitive inventory data in an Amazon S3 bucket. The application will use an AWS Key Management Service (AWS KMS) customer managed key to encrypt the data in Amazon S3. The inventory data in Amazon S3 will be shared with hundreds of vendors. All vendors will use AWS principals from their own AWS accounts to access the data in Amazon S3. The vendor list might change weekly. The security engineer needs to find a solution that supports cross-account access. Which solution is the MOST operationally efficient way to manage access control for the customer managed key?

AUse KMS grants to manage key access. Programmatically create and revoke grants to manage vendor access. (correct answer)
BUse am IAM role to manage key access. Programmatically update the IAM role policies to manage vendor access.
CUse KMS key policies to manage key access. Programmatically update the KMS key policies to manage vendor access.
DUse delegated access across AWS accounts by using IAM roles to manage key access. Programmatically update the IAM trust policy to manage cross-account vendor access.

Reveal answer & explanation

Correct answer: A

The correct answer is A. Option A: Use KMS grants to manage key access. Programmatically create and revoke grants to manage vendor access.

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

Showing questions 241–260 of 307 · Page 13 of 16