Amazon SCS-C02

Choose your answer

• A

  Use the DynamoDB on-demand backup capability to create a backup plan. Configure a lifecycle policy to expire backups after 3 months.

• B

  Use AWS DataSync to create a backup plan. Add a backup rule that includes a retention period of 3 months.

• C

  Use AWS Backup to create a backup plan. Add a backup rule that includes a retention period of 3 months.

• D

  Set the backup frequency by using a cron schedule expression. Assign each DynamoDB table to the backup plan.

• E

  Set the backup frequency by using a rate schedule expression. Assign each DynamoDB table to the backup plan.

Pick an answer to check it, or press Show answer to see the correct one.

Choose your answer

• A

  Use AD Connector to create users and groups for all employees that require access to AWS accounts. Assign AD Connector groups to AWS accounts and link to the IAM roles in accordance with the employees’ job functions and access requirements. Instruct employees to access AWS accounts by using the AWS Directory Service user portal.

• B

  Use an IAM Identity Center default directory to create users and groups for all employees that require access to AWS accounts. Assign groups to AWS accounts and link to permission sets in accordance with the employees’ job functions and access requirements. Instruct employees to access AWS accounts by using the IAM Identity Center user portal.

• C

  Use an IAM Identity Center default directory to create users and groups for all employees that require access to AWS accounts. Link IAM Identity Center groups to the IAM users present in all accounts to inherit existing permissions. Instruct employees to access AWS accounts by using the IAM Identity Center user portal.

• D

  Use AWS Directory Service for Microsoft Active Directory to create users and groups for all employees that require access to AWS accounts. Enable AWS Management Console access in the created directory and specify IAM Identity Center as a source of information for integrated accounts and permission sets. Instruct employees to access AWS accounts by using the AWS Directory Service user portal.

Pick an answer to check it, or press Show answer to see the correct one.

Choose your answer

• A

  Configure GuardDuty to send the event to an Amazon Kinesis data stream. Process the event with an Amazon Kinesis Data Analytics for Apache Flink application that sends a notification to the company through Amazon Simple Notification Service (Amazon SNS). Add rules to the network ACL to block traffic to and from the suspicious instance.

• B

  Configure GuardDuty to send the event to Amazon EventBridge. Deploy an AWS WAF web ACL. Process the event with an AWS Lambda function that sends a notification to the company through Amazon Simple Notification Service (Amazon SNS) and adds a web ACL rule to block traffic to and from the suspicious instance.

• C

  Enable AWS Security Hub to ingest GuardDuty findings and send the event to Amazon EventBridge. Deploy AWS Network Firewall. Process the event with an AWS Lambda function that adds a rule to a Network Firewall firewall policy to block traffic to and from the suspicious instance.

• D

  Enable AWS Security Hub to ingest GuardDuty findings. Configure an Amazon Kinesis data stream as an event destination for Security Hub. Process the event with an AWS Lambda function that replaces the security group of the suspicious instance with a security group that does not allow any connections.

Pick an answer to check it, or press Show answer to see the correct one.

Choose your answer

• A

  Log in to the AWS account by using read-only credentials. Review the GuardDuty finding for details about the IAM credentials that were used. Use the IAM console to add a DenyAll policy to the IAM principal.

• B

  Log in to the AWS account by using read-only credentials. Review the GuardDuty finding to determine which API calls initiated the finding. Use Amazon Detective to review the API calls in context.

• C

  Log in to the AWS account by using administrator credentials. Review the GuardDuty finding for details about the IAM credentials that were used. Use the IAM console to add a DenyAll policy to the IAM principal.

• D

  Log in to the AWS account by using read-only credentials. Review the GuardDuty finding to determine which API calls initiated the finding. Use AWS CloudTrail Insights and AWS CloudTrail Lake to review the API calls in context.

Pick an answer to check it, or press Show answer to see the correct one.

Choose your answer

• A

  In Account B, create a bucket ACL to allow the user from Account A to access the S3 bucket in Account B.

• B

  In Account B, create an object ACL to allow the user from Account A to access all the objects in the S3 bucket in Account B.

• C

  In Account B, create a bucket policy to allow the user from Account A to access the S3 bucket in Account B.

• D

  In Account B, create a user policy to allow the user from Account A to access the S3 bucket in Account B.

Pick an answer to check it, or press Show answer to see the correct one.