Task 2.1: Design and Test an Incident Response Plan SCS-C03 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A security engineer is configuring AWS Shield Advanced for a web application. Which resource can be protected by AWS Shield Advanced?

   • AAmazon CloudFront distributions
   • BAWS Lambda functions
   • CAmazon S3 buckets
   • DAmazon EC2 instances
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has an incident response plan but has never tested it. The security team wants to validate the plan's effectiveness without impacting production systems. What should they do first?

   • AConduct a tabletop exercise with the incident response team to walk through the plan's procedures.
   • BUse AWS Fault Injection Service to disrupt a production instance and observe the response.
   • CRun a full simulation in a production environment without warning the team.
   • DDeploy the plan to a production account and wait for a real incident to test it.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company wants to improve its detection capabilities for incident response. They need to monitor for unauthorized API calls, detect potential malicious activity, and track resource configuration changes. Which combination of services should they deploy?

   • AAWS CloudTrail, AWS Shield Advanced, and AWS WAF
   • BAWS CloudTrail, Amazon GuardDuty, and AWS Config
   • CAWS Config, Amazon Inspector, and AWS CloudTrail
   • DAmazon GuardDuty, AWS Security Hub, and AWS Trusted Advisor
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A security engineer is setting up access for incident responders. The engineer wants to ensure that the access is temporary and automatically expires after a set period. Which AWS feature should the engineer use?

   • AAWS Organizations service control policies
   • BAWS Key Management Service (KMS) keys
   • CIAM users with long-term access keys
   • DIAM roles with a session duration policy
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   A security engineer wants to use Amazon SageMaker AI notebooks for incident response. What is a primary benefit of using SageMaker AI notebooks for forensic analysis?

   • AThey provide a built-in intrusion detection system
   • BThey provide a managed, interactive environment for running code and visualizing data
   • CThey automatically remediate security findings
   • DThey replace the need for AWS CloudTrail
   Reveal Solution Discussion Select an answer first