Free SCS-C03 – AWS Certified Specialty Practice Test Question

Select an option, then click Submit answer.

• ○

  Option A

• ○

  Option B

• ○

  Option C

• ○

  Option D
  
  

Select an option, then click Submit answer.

• ○

  Filter IAM CloudTrail logs for KeyRotaton events

• ○

  Monitor Amazon CloudWatcn Events for any IAM KMS CMK rotation events

• ○

  Using the IAM CLI. run the IAM kms gel-key-relation-status operation with the --key-id parameter to check the CMK rotation date

• ○

  Use Amazon Athena to query IAM CloudTrail logs saved in an S3 bucket to filter Generate New Key events
  
  

Select an option, then click Submit answer.

• ○

  Add an origin custom header Set the viewer protocol policy to HTTP and HTTPS Set the origin protocol pokey to HTTPS only Update the application to validate the CloudFront custom header

• ○

  Add an origin custom header Set the viewer protocol policy to HTTPS only Set the origin protocol policy to match viewer Update the application to validate the CloudFront custom header.

• ○

  Add an origin custom header Set the viewer protocol policy to redirect HTTP to HTTPS Set the origin protocol policy to HTTP only Update the application to validate the CloudFront custom header.

• ○

  Add an origin custom header Set the viewer protocol policy to redirect HTTP to HTTPS. Set the origin protocol policy to HTTPS only Update the application to validate the CloudFront custom header
  

Select an option, then click Submit answer.

• ○

  Configure the CMK key policy to allow only the Amazon S3 service to use the kms Encrypt action

• ○

  Configure the CMK key policy to allow IAM KMS actions only when the kms ViaService condition matches the Amazon S3 service name.

• ○

  Configure the IAM user's policy lo allow KMS to pass a rote lo Amazon S3

• ○

  Configure the IAM user's policy to allow only Amazon S3 operations when they are combined with the
  CMK
  
  

Select an option, then click Submit answer.

• ○

  In the security group of the EC2 instance, allow inbound ICMP traffic.

• ○

  In the security group of the EC2 instance, allow outbound ICMP traffic.

• ○

  In the VPC's NACL, allow inbound ICMP traffic.

• ○

  In the VPC's NACL, allow outbound ICMP traffic.
  
  

Select all that apply, then click Submit answer.

• ○

  In the security account configure an IAM role for the new Lambda function. Attach an IAM policy that allows access to the KMS key in the security account.

• ○

  In the development account configure an IAM role for the new Lambda function. Attach a key policy
  that allows access to the KMS key in the security account.

• ○

  In the development account configure an IAM role for the new Lambda function. Attach an IAM policy that allows access to the KMS key in the security account.

• ○

  Configure a key policy for the KMS key m the security account to allow access to the IAM role of the new Lambda function in the security account.

• ○

  Configure a key policy for the KMS key in the security account to allow access to the IAM role of the new Lambda function in the development account.
  
  

Select an option, then click Submit answer.

• ○

  Configure cluster security groups for each application module to control access to database users that are required for read-only and readwrite

• ○

  Configure a VPC endpoint for Amazon Redshift Configure an endpoint policy that maps database users to each application module, and allow access to the tables that are required for read-only and read/write

• ○

  Configure an 1AM policy for each module Specify the ARN of an Amazon Redshift database user that allows the GetClusterCredentials API call

• ○

  Create local database users for each module

• ○

  Configure an 1AM policy for each module Specify the ARN of an 1AM user that allows the GetClusterCredentials API call
  
  

Select an option, then click Submit answer.

• ○

  Use AWS SSO to set up service-linked roles with IAM policy statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.

• ○

  Deactivate AWS Security Token Service (AWS STS) in Regions that the developers are not allowed to use.

• ○

  Create SCPs that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.

• ○

  For each AWS account, create tailored identity-based policies for AWS SSO. Use statements that include the Condition, Resource, and NotAction elements to allow access to only the Regions and services that are needed.
  
  

Select an option, then click Submit answer.

• ○

  Delete the key pair from the EC2 console. Create a new key pair.

• ○

  Use the ModifylnstanceAttribute API operation to change the key on any EC2 instance that is using the key.

• ○

  Restrict SSH access in the security group to only known corporate IP addresses.

• ○

  Update the key pair in any AMI that is used to launch the EC2 instances. Restart the EC2 instances.
  
  

Select an option, then click Submit answer.

• ○

  For each team, create an AM policy similar to the one that fellows Populate the ec2: ResourceTag/Team condition key with a proper team name Attach resulting policies to the corresponding IAM roles.
  

• ○

  For each team create an IAM policy similar to the one that follows Populate the IAM TagKeys/Team condition key with a proper team name. Attach the resuming policies to the corresponding IAM roles.
  

• ○

  Tag each IAM role with a Team lag key. and use the team name in the tag value. Create an IAM policy similar to the one that follows, and attach 4 to all the IAM roles used by developers.
  

• ○

  Tag each IAM role with the Team key, and use the team name in the tag value. Create an IAM policy similar to the one that follows, and it to all the IAM roles used by developers.