🔍

SCS-C02 — questions

Page 14 of 16 · 307 total questions.

SCS-C02 Question 261

Single page →
Topic 1 · Question 261

A company runs an application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). A security engineer needs to provide secure access to the application without requiring the use of a VPN. Users should be able to access the application only when they meet specific security conditions, including a defined device posture. Which solution will meet these requirements?

  • ACreate an AWS WAF web ACL. Configure a custom response to block traffic that does not align with the defined device posture.
  • BConfigure AWS Verified Access. Add the application by creating an endpoint for the ALB. (correct answer)
  • CConfigure Amazon Verified Permissions. Use a policy-based access control (PBAC) policy to perform authorization.
  • DConfigure Amazon Verified Permissions. Add the application by creating an endpoint for the ALB.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure AWS Verified Access. Add the application by creating an endpoint for the ALB.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 262

Single page →
Topic 1 · Question 262

A company needs to retain data that is stored in Amazon CloudWatch Logs log groups. The company must retain this data for 90 days. The company must receive notification in AWS Security Hub when log group retention is not compliant with this requirement. Which solution will provide the appropriate notification?

  • ACreate a Security Hub custom action to assess the log group retention period.
  • BCreate a data protection policy in CloudWatch Logs to assess the log group retention period.
  • CCreate a Security Hub automation rule. Configure the automation rule to assess the log group retention period.
  • DUse the AWS Config managed rule that assesses the log group retention period. Ensure that AWS Config integration is enabled in Security Hub. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use the AWS Config managed rule that assesses the log group retention period. Ensure that AWS Config integration is enabled in Security Hub.

Explanation

AWS Security Hub centralizes security findings and compliance checks. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 263

Single page →
Topic 1 · Question 263

A company needs to prevent Amazon S3 objects from being shared with IAM identities outside of the company’s organization in AWS Organizations. A security engineer is creating and deploying an SCP to accomplish this goal. The company has enabled the S3 Block Public Access feature on all of its S3 buckets. What should the SCP do to meet these requirements?

  • ADeny the S3:* action with a Condition element that comprises an operator of StringNotEquals, a key of aws:ResourceOrgID, and a value of S{aws PrincipalOrgID}. (correct answer)
  • BDeny the S3:PutAccountPublicAccessBlock action with a Condition element that comprises an operator of StringLike, a key of aws:PrincipalArn, and the values of the external IAM principals.
  • CAllow the S3:* action with a Condition element that comprises an operator of StringNotEquals, a key of aws:PrincipalOrgID, and a value of S{aws:PrincipalOrgID}.
  • DDeny the S3:* action with a Condition element that comprises an operator of StringLike, a key of aws:PrincipalArn, and the values of the external IAM principals
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deny the S3:* action with a Condition element that comprises an operator of StringNotEquals, a key of aws:ResourceOrgID, and a value of S{aws PrincipalOrgID}.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. The aws:PrincipalOrgID condition key restricts access to accounts within your AWS Organization with minimal effort.

SCS-C02 Question 264

Single page →
Topic 1 · Question 264

A security engineer is implementing authentication for a multi-account environment by using federated access with SAML 2.0. The security engineer has configured AWS IAM Identity Center as an identity provider (IdP). The security engineer also has created IAM roles to grant access to the AWS accounts. A federated user reports an authentication failure when the user attempts to authenticate with the new system. What should the security engineer do to troubleshoot this issue in the MOST operationally efficient way?

  • AReview the SAML IdP logs to identify errors. Check AWS CloudTrail to verify the API calls that the user made. (correct answer)
  • BReview the SAML IdP logs to identify errors. Use the IAM policy simulator to validate access to the IAM roles.
  • CUse IAM access advisor to review recent service access. Use the IAM policy simulator to validate access to the IAM roles.
  • DRecreate the SAML IdP in a separate account to confirm the behavior that the user is experiencing.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Review the SAML IdP logs to identify errors. Check AWS CloudTrail to verify the API calls that the user made.

Explanation

AWS CloudTrail records API activity for auditing and governance.

SCS-C02 Question 265

Single page →
Topic 1 · Question 265

A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). A security engineer must prevent any modifications to the data in the S3 bucket. Which solution will meet this requirement?

  • AConfigure S3 bucket policies to deny DELETE and PUT object permissions.
  • BConfigure S3 Object Lock in compliance mode with S3 bucket versioning enabled. (correct answer)
  • CChange the encryption on the S3 bucket to use AWS Key Management Service (AWS KMS) customer managed keys.
  • DConfigure the S3 bucket with multi-factor authentication (MFA) delete protection.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure S3 Object Lock in compliance mode with S3 bucket versioning enabled.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 266

Single page →
Topic 1 · Question 266 · Select all that apply

A company is developing a new serverless application that uses AWS Lambda functions. The company uses AWS CloudFormation to deploy the Lambda functions. The company’s developers are trying to debug a Lambda function that is deployed. The developers cannot debug the Lambda function because the Lambda function is not logging its output to Amazon CloudWatch Logs. Which combination of steps should a security engineer take to resolve this issue? (Choose two.)

  • ACheck the role that is defined in the CloudFormation template and is passed to the Lambda function. Ensure that the role has a trust policy that allows the sts:AssumeRole action by the service principal lambda amazonaws.com. (correct answer)
  • BCheck the execution role that is configured in the CloudFormation template for the Lambda function. Ensure that the execution role has the necessary permissions to write to CloudWatch Logs. (correct answer)
  • CCheck the Lambda function configuration in the CloudFormation template. Ensure that the Lambda function has an AWS X-Ray tracing configuration that is set to Active mode or PassThrough mode.
  • DCheck the resource policy that is configured in the CloudFormation template for the Lambda function. Ensure that the resource policy has the necessary permissions to write to CloudWatch Logs.
  • ECheck the role that the developers use to debug the Lambda function. Ensure that the role has a trust policy that allows the sts:AssumeRole action by the service principal lambda.amazonaws.com.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Check the role that is defined in the CloudFormation template and is passed to the Lambda function. Ensure that the role has a trust policy that allows the sts:AssumeRole action by the service principal lambda amazona... Option B: Check the execution role that is configured in the CloudFormation template for the Lambda function. Ensure that the execution role has the necessary permissions to write to CloudWatch Logs.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 267

Single page →
Topic 1 · Question 267

A company uses a collaboration application. A security engineer needs to configure automated alerts from AWS Security Hub in the us-west-2 Region for the application. The security engineer wants to receive an alert in a channel in the application every time Security Hub receives a new finding. The security engineer creates an AWS Lambda function to convert the message to the format that the application requires. The Lambda function also sends the message to the application’s API. The security engineer configures a corresponding Amazon EventBridge rule that specifies the Lambda function as the target. After the EventBridge rule is implemented, the channel begins to constantly receive alerts from Security Hub. Many of the alerts are Amazon Inspector alerts that do not require any action. The security engineer wants to stop the Amazon Inspector alerts. Which solution will meet this requirement with the LEAST operational effort?

  • AUpdate the Lambda function code to find pattern matches of events from Amazon Inspector and to suppress the findings.
  • BCreate a Security Hub custom action that automatically sends findings from all services except Amazon Inspector to the EventBridge event bus.
  • CModify the value of the ProductArn attribute in the event pattern of the EventBridge rule to “anything-but”: [“arn:aws:securityhub:us-west-2::product/aws/inspector”]. (correct answer)
  • DCreate an Amazon Simple Notification Service (Amazon SNS) topic to send messages to the application. Set a filter policy on the topic subscriptions to reject any messages that contain the product/aws/inspector string.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Modify the value of the ProductArn attribute in the event pattern of the EventBridge rule to “anything-but”: [“arn:aws:securityhub:us-west-2::product/aws/inspector”].

Explanation

Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon Inspector automatically scans workloads for software vulnerabilities.

SCS-C02 Question 268

Single page →
Topic 1 · Question 268

A company has an organization in AWS Organizations. The organization consists of multiple OUs. The company must prevent IAM principals from outside the organization from accessing the organization’s Amazon S3 buckets. The solution must not affect the existing access that the OUs have to the S3 buckets. Which solution will meet these requirements?

  • AConfigure S3 Block Public Access for all S3 buckets.
  • BConfigure S3 Block Public Access for all AWS accounts.
  • CDeploy an SCP that includes the “aws:ResourceOrgPaths”: “${aws:PrincipalOrgPaths}” condition.
  • DDeploy an SCP that includes the “aws:ResourceOrgID”: “${aws:PrincipalOrgID}" condition. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Deploy an SCP that includes the “aws:ResourceOrgID”: “${aws:PrincipalOrgID}" condition.

Explanation

The aws:PrincipalOrgID condition key restricts access to accounts within your AWS Organization with minimal effort. Service Control Policies set guardrails on what accounts in an organization can do.

SCS-C02 Question 269

Single page →
Topic 1 · Question 269

A company needs to implement data lifecycle management for Amazon RDS snapshots. The company will use AWS Backup to manage the snapshots. The company must retain RDS automated snapshots for 5 years and will use Amazon S3 for long-term archival storage. Which solution will meet these requirements?

  • AUse AWS Backup to apply a 5-year retention tag to the RDS snapshots.
  • BEnable versioning on the S3 bucket that AWS Backup uses for the RDS snapshots. Configure a 5-year retention period.
  • CCreate an S3 Lifecycle policy. Include a 5-year retention period for the S3 bucket that AWS Backup uses for the RDS snapshots.
  • DCreate a backup plan in AWS Backup. Configure a 5-year retention period. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a backup plan in AWS Backup. Configure a 5-year retention period.

Explanation

AWS Backup centrally automates and manages backups across AWS services. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 270

Single page →
Topic 1 · Question 270

A company’s security policy requires all Amazon EC2 instances to use the Amazon Time Sync Service. AWS CloudTrail trails are enabled in all of the company’s AWS accounts. VPC flow logs are enabled for all VPCs. A security engineer must identify any EC2 instances that attempt to use Network Time Protocol (NTP) servers on the internet. Which solution will meet these requirements?

  • AMonitor CloudTrail logs for API calls to non-standard time servers.
  • BMonitor CloudTrail logs for API calls to the Amazon Time Sync Service.
  • CMonitor VPC flow logs for traffic to non-standard time servers. (correct answer)
  • DMonitor VPC flow logs for traffic to the Amazon Time Sync Service.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Monitor VPC flow logs for traffic to non-standard time servers.

SCS-C02 Question 271

Single page →
Topic 1 · Question 271

A company has a multi-account strategy that uses an organization in AWS Organizations with all features enabled. The company has enabled trusted access for AWS Account Management. New accounts are provisioned through AWS Control Tower Account Factory. The company must ensure that all new accounts in the organization become AWS Security Hub member accounts. Which solution will meet these requirements with the LEAST development effort?

  • AEnable Security Hub in the organization’s management account. Create an AWS Step Functions workflow. Create an Amazon EventBridge rule to invoke the workflow when a CreateAccount event occurs.
  • BEnable Security Hub in the organization’s management account. Wait for all new accounts to complete automatic onboarding.
  • CEnable Security Hub in the organization’s management account. Create an AWS Lambda function to enable Security Hub for new accounts. Invoke the Lambda function by using an AWS Control Tower lifecycle event that occurs when a new account is provisioned.
  • DUse the organization’s management account to designate a Security Hub delegated administrator account. In the delegated administrator account, create a configuration policy to enable Security Hub. Associate the configuration policy with the organization root. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use the organization’s management account to designate a Security Hub delegated administrator account. In the delegated administrator account, create a configuration policy to enable Security Hub. Associate the config...

Explanation

AWS Security Hub centralizes security findings and compliance checks. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 272

Single page →
Topic 1 · Question 272

A company uses Amazon Elastic Kubernetes Service (Amazon EKS) clusters to run its Kubernetes-based applications. The company uses Amazon GuardDuty to protect the applications. EKS Protection is enabled in GuardDuty. However, the corresponding GuardDuty feature is not monitoring the Kubernetes-based applications. Which solution will cause GuardDuty to monitor the Kubernetes-based applications?

  • AEnable VPC flow logs for the VPC that hosts the EKS clusters.
  • BAssign the CloudWatchEventsFullAccess AWS managed policy to the EKS clusters.
  • CEnsure that the AmazonGuardDutyFullAccess AWS managed policy is attached to the GuardDuty service role.
  • DEnable the control plane logs in Amazon EKS. Ensure that the logs are ingested into Amazon CloudWatch. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable the control plane logs in Amazon EKS. Ensure that the logs are ingested into Amazon CloudWatch.

Explanation

Amazon EKS runs managed Kubernetes when you need the Kubernetes ecosystem. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SCS-C02 Question 273

Single page →
Topic 1 · Question 273

A company needs to log object-level activity in its Amazon S3 buckets. The company also needs to validate the integrity of the log file by using a digital signature. Which solution will meet these requirements?

  • ACreate an AWS CloudTrail trail with log file validation enabled. Enable data events. Specify Amazon S3 as the data event type. (correct answer)
  • BCreate a new S3 bucket for S3 server access logs. Configure the existing S3 buckets to send their S3 server access logs to the new S3 bucket.
  • CCreate an Amazon CloudWatch Logs log group. Configure the existing S3 buckets to send their S3 server access logs to the log group.
  • DCreate a new S3 bucket for S3 server access logs with log file validation enabled. Enable data events. Specify Amazon S3 as the data event type.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an AWS CloudTrail trail with log file validation enabled. Enable data events. Specify Amazon S3 as the data event type.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS CloudTrail records API activity for auditing and governance.

SCS-C02 Question 274

Single page →
Topic 1 · Question 274 · Select all that apply

A company has a new web-based account management system for an online game. Players create a unique username and password to log in to the system. The company has implemented an AWS WAF web ACL for the system. The web ACL includes the core rule set (CRS) AWS managed rule group on the Application Load Balancer that serves the system. The company’s security team finds that the system was the target of a credential stuffing attack. Credentials that were exposed in other breaches were used to try to log in to the system. The security team must implement a solution to reduce the chance of a successful credential stuffing attack in the future. The solution also must minimize impact on legitimate users of the system. Which combination of actions will meet these requirements? (Choose two.)

  • ACreate an Amazon CloudWatch custom metric to analyze the number of successful login responses from a single IP address. (correct answer)
  • BAdd the account takeover prevention (ATP) AWS managed rule group to the web ACL. Configure the rule group to inspect login requests to the system. Block any requests that have the awswaf:managed:aws:atp:signal:credential_compromised label. (correct answer)
  • CConfigure a default web ACL action that requires all users to solve a CAPTCHA puzzle when they log in.
  • DImplement IP-based match rules in the web ACL for any IP addresses that generate many successful login responses. Block any IP addresses that generate many successful logins.
  • ECreate a custom block response that redirects users to a secure workflow to reset their password inside the system.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: Create an Amazon CloudWatch custom metric to analyze the number of successful login responses from a single IP address. Option B: Add the account takeover prevention (ATP) AWS managed rule group to the web ACL. Configure the rule group to inspect login requests to the system. Block any requests that have the awswaf:managed:aws:atp:signal:credent...

Explanation

AWS WAF protects web applications from common exploits and malicious requests. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 275

Single page →
Topic 1 · Question 275

A company runs workloads on Amazon EC2 instances. The company needs to continually monitor the EC2 instances for software vulnerabilities and must display the findings in AWS Security Hub. The company must not install agents on the EC2 instances. Which solution will meet these requirements?

  • AEnable Amazon Inspector. Set the scan mode to hybrid scanning. Enable the integration for Amazon Inspector in Security Hub. (correct answer)
  • BUse Security Hub to enable the AWS Foundational Security Best Practices standard. Wait for Security Hub to generate the findings.
  • CEnable Amazon GuardDuty. Initiate on-demand malware scans by using GuardDuty Malware Protection. Enable the integration for GuardDuty in Security Hub.
  • DUse AWS Config managed rules to detect EC2 software vulnerabilities. Ensure that Security Hub has the AWS Config integration enabled.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Enable Amazon Inspector. Set the scan mode to hybrid scanning. Enable the integration for Amazon Inspector in Security Hub.

Explanation

AWS Security Hub centralizes security findings and compliance checks. Amazon Inspector automatically scans workloads for software vulnerabilities.

SCS-C02 Question 276

Single page →
Topic 1 · Question 276

A company runs a custom online gaming application. The company uses Amazon Cognito for user authentication and authorization. A security engineer wants to use AWS to implement fine-grained authorization on resources in the custom application. The security engineer must implement a solution that uses the user attributes that exist in Cognito. The company has already set up a user pool and an identity pool in Cognito. Which solution will meet these requirements?

  • ACreate a set of IAM roles and IAM policies. Configure the Cognito identity pool to assign users to the IAM roles.
  • BCreate a policy store in Amazon Verified Permissions. Configure Cognito as the identity source. Map Cognito access tokens to the Verified Permissions schema. (correct answer)
  • CCreate customer managed permissions by using AWS Resource Access Manager (AWS RAM). Configure the Cognito identity pool to assign users to the customer managed permissions.
  • DCreate a set of IAM users and IAM policies. Configure the Cognito user pool to assign users to the IAM users.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a policy store in Amazon Verified Permissions. Configure Cognito as the identity source. Map Cognito access tokens to the Verified Permissions schema.

Explanation

Amazon Cognito manages user sign-up, sign-in and federated identity for applications. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 277

Single page →
Topic 1 · Question 277

A company wants to automate the creation of a security report. The company has an AWS Lambda function that gathers data from Amazon Inspector findings stored in AWS Security Hub in the us-west-2 Region. The Lambda function then needs to create a daily report by using an Amazon EventBridge schedule. A security engineer discovers that the Lambda function is failing to create the report. The security engineer must implement a solution that corrects the issue and provides least privilege permissions. Which solution will meet these requirements?

  • ACreate a resource-based policy that allows Security Hub access to the ARN of the Lambda function.
  • BAttach the AWSSecurityHubReadOnlyAccess AWS managed policy to the Lambda function’s execution role. (correct answer)
  • CGrant the Lambda function’s execution role read-only permissions to access Amazon Inspector and Security Hub.
  • DCreate a custom IAM policy that grants the Security Hub Get*, List*, Batch*, and Describe* permissions on the arn:aws:securityhub:us-west-2::product/aws/inspector/* resource. Attach the policy to the Lambda function’s execution role.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Attach the AWSSecurityHubReadOnlyAccess AWS managed policy to the Lambda function’s execution role.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead.

SCS-C02 Question 278

Single page →
Topic 1 · Question 278

A company must retain backup copies of Amazon RDS DB instances and Amazon Elastic Block Store (Amazon EBS) volumes. The company must retain the backup copies in data centers that are several hundred miles apart. Which solution will meet these requirements with the LEAST operational overhead?

  • AConfigure AWS Backup to create the backups according to the needed schedule. In the backup plan, specify multiple Availability Zones as backup destinations.
  • BConfigure Amazon Data Lifecycle Manager to create the backups. Configure the Amazon Data Lifecycle Manager policy to copy the backups to an Amazon S3 bucket. Enable replication on the S3 bucket.
  • CConfigure AWS Backup to create the backups according to the needed schedule. Create a destination backup vault in a different AWS Region. Configure AWS Backup to copy the backups to the destination backup vault. (correct answer)
  • DConfigure Amazon Data Lifecycle Manager to create the backups. Create an AWS Lambda function to copy the backups to a different AWS Region. Use Amazon EventBridge to invoke the Lambda function on a schedule.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Configure AWS Backup to create the backups according to the needed schedule. Create a destination backup vault in a different AWS Region. Configure AWS Backup to copy the backups to the destination backup vault.

Explanation

AWS Backup centrally automates and manages backups across AWS services. AWS Config tracks resource configuration changes and evaluates compliance.

SCS-C02 Question 279

Single page →
Topic 1 · Question 279

A security engineer has noticed an unusually high amount of traffic coming from a single IP address. This was discovered by analyzing the Application Load Balancer’s access logs. How can the security engineer limit the number of requests from a specific IP address without blocking the IP address?

  • AAdd a rule to the Application Load Balancer to route the traffic originating from the IP address in question and show a static webpage.
  • BImplement a rate-based rule with AWS WAF. (correct answer)
  • CUse AWS Shield to limit the originating traffic hit rate.
  • DImplement the GeoLocation feature in Amazon Route 53.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Implement a rate-based rule with AWS WAF.

Explanation

AWS WAF protects web applications from common exploits and malicious requests.

SCS-C02 Question 280

Single page →
Topic 1 · Question 280

A company runs workloads that are spread across hundreds of Amazon EC2 instances. During a recent security incident, an EC2 instance was compromised and ran malware code until the company manually terminated the instance. The company is now using Amazon GuardDuty to detect malware on EC2 instances. A security engineer needs to implement a solution that automates a response when GuardDuty determines that an instance is infected. The solution must mitigate the incident and must comply with the AWS Well-Architected Framework guidance for incident response. Which solution will meet these requirements?

  • AConfigure AWS Systems Manager Run Command to run when a GuardDuty scan determines that an instance is infected. Use Run Command to remove all network adapters from the operating system of the infected instance. Use Run Command to also add a tag of “Infected” to the instance.
  • BCreate an AWS Lambda function that runs when a GuardDuty scan determines that an instance is infected. Program the Lambda function to delete all elastic network interfaces that are associated with the instance. Program the Lambda function to also add a tag of “Infected” to the instance.
  • CCreate an AWS Lambda function that runs when a GuardDuty scan determines that an instance is infected. Program the Lambda function to detach all Amazon Elastic Block Store (Amazon EBS) volumes from the instance. Program the Lambda function to also add a tag of “Infected” to the EBS volumes and to terminate the instance afterward. (correct answer)
  • DDefine a separate VPC to isolate EC2 instances. Define a security group that does not allow any network traffic. Create an AWS Lambda function that runs when a GuardDuty scan determines that an instance is infected. Program the Lambda function to move the instance into the separate VPC and to assign the security group to the instance.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an AWS Lambda function that runs when a GuardDuty scan determines that an instance is infected. Program the Lambda function to detach all Amazon Elastic Block Store (Amazon EBS) volumes from the instance. Progr...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EBS provides block storage attached to a single EC2 instance. Amazon GuardDuty continuously monitors for threats and malicious activity.

Showing questions 261–280 of 307 · Page 14 of 16