Task 1.1: Design and Implement Monitoring and Alerting Solutions for an AWS Account or Organization SCS-C03 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is required by its compliance team to monitor all API calls made in its AWS account, especially those that modify IAM policies. They want to be alerted in near real-time when an IAM policy is changed. Which solution should they implement?

   • AEnable AWS Config and create a rule that checks for changes to IAM policies, then configure an SNS notification on the rule.
   • BUse Amazon GuardDuty to monitor for IAM policy changes.
   • CUse AWS Systems Manager to monitor IAM policy changes and send alerts.
   • DEnable AWS CloudTrail and create an Amazon EventBridge rule that matches IAM policy change events and sends notifications to an SNS topic.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has enabled AWS Security Hub, Amazon GuardDuty, and Amazon Macie in its main account. The security operations team wants a single dashboard that shows consolidated findings from all three services, and they want to be notified when a new critical finding is generated. What should the team do to meet these requirements?

   • AConfigure Amazon QuickSight to connect to the Security Hub API and build a dashboard, then set up an SNS topic for each service's findings.
   • BCreate a custom CloudWatch dashboard that queries each service's API directly to display findings, and configure a CloudWatch alarm for each service.
   • CEnable AWS Organizations and use the management account to view all findings in the GuardDuty console.
   • DUse the Security Hub console as the single pane of glass, and create an Amazon EventBridge rule that matches Security Hub findings to send notifications to an Amazon SNS topic.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company has a requirement to automatically remediate S3 buckets that are not encrypted with AWS KMS. They have enabled AWS Config and created a rule to detect non-compliant buckets. What is the next step to automate the remediation?

   • AConfigure an automatic remediation action on the AWS Config rule using an AWS Systems Manager Automation document.
   • BCreate an Amazon EventBridge rule that triggers an AWS Lambda function to encrypt the bucket when the AWS Config rule is non-compliant.
   • CUse AWS Organizations to apply an SCP that denies the creation of unencrypted S3 buckets.
   • DEnable AWS Trusted Advisor and use its automatic remediation feature for S3 encryption.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team needs to ensure that all Amazon S3 buckets in their organization are configured to block public access. They want to automatically remediate any bucket that is found to be non-compliant. Which solution should they implement?

   • ACreate an AWS Config rule that checks for public access, and configure an automatic remediation action using AWS Systems Manager Automation to apply the S3 Block Public Access setting.
   • BEnable AWS Trusted Advisor and use its S3 Bucket Permissions check to automatically fix any bucket with public access.
   • CUse AWS Organizations to apply a Service Control Policy (SCP) that denies the s3:PutBucketPublicAccessBlock action.
   • DCreate an Amazon EventBridge rule that detects S3 bucket creation events and triggers an AWS Lambda function to apply the Block Public Access setting.
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A company runs a critical application on EC2 instances. The security team wants to be alerted if the application becomes unavailable, but they also want to avoid false alarms caused by brief network blips. They have configured a CloudWatch alarm on the StatusCheckFailed metric. What should they do to reduce false alarms?

   • AChange the alarm's evaluation period to 1 minute.
   • BUse a static threshold instead of an anomaly detection band.
   • CDisable the alarm's actions and only use it for monitoring.
   • DIncrease the number of consecutive periods the alarm must be in the ALARM state before it triggers an action.
   Reveal Solution Discussion Select an answer first