Task 2.1: Design and Test an Incident Response Plan SCS-C03 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security engineer is designing the incident response (IR) plan for a company that uses AWS Organizations with multiple accounts. The plan must allow designated responders to access any account in the organization within minutes of an incident, but must not grant standing access to production environments. What should the engineer do to meet these requirements?

   • ACreate an IAM user for each responder in the management account and attach the AdministratorAccess policy to their user accounts.
   • BCreate a single IAM role in the management account with full administrative permissions and instruct responders to switch to that role when needed.
   • CUse AWS Systems Manager Incident Manager to create an on-call schedule and automatically grant responders administrative access when an incident is declared.
   • DProvision a pre-configured IAM role in each account with the necessary permissions, and use AWS IAM Identity Center (SSO) with permission sets that responders can assume during an incident.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   A company wants to manage failover and recovery of its applications during an incident to ensure availability. Which AWS service should the company use?

   • AAWS CloudTrail
   • BAmazon Application Recovery Controller
   • CAWS Config
   • DAmazon GuardDuty
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A security engineer wants to use Amazon Application Recovery Controller to ensure application availability during an incident. What is a primary feature of this service?

   • AIt automatically patches vulnerabilities
   • BIt provides forensic analysis
   • CIt provides control over failover and recovery actions
   • DIt detects security threats
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   A security team wants to automate the collection and analysis of forensic evidence from EC2 instances during an incident. Which AWS solution is specifically designed for this purpose?

   • AAutomated Forensics Orchestrator for Amazon EC2
   • BAWS CloudTrail
   • CAmazon GuardDuty
   • DAWS Config
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A security operations team uses OpsCenter to manage incidents. They want to automatically create OpsItems from GuardDuty findings, but they also want to enrich the OpsItem with additional context, such as the affected resource tags and the owner of the resource. They also want to automatically run a remediation runbook for certain types of findings. What should they implement?

   • AUse EventBridge to route GuardDuty findings to OpsCenter, and use a Lambda function to enrich the OpsItem with resource tags and owner information.
   • BUse AWS Config to detect GuardDuty findings and create OpsItems with enrichment.
   • CUse OpsCenter's built-in enrichment feature to add resource tags and owner information.
   • DManually create OpsItems from GuardDuty findings and add enrichment.
   Reveal Solution Discussion Select an answer first