Task 2.1: Design and Test an Incident Response Plan SCS-C03 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A company is designing a multi-tier web application on AWS. They want to minimize the blast radius of a potential security incident by ensuring that a compromise of the web tier does not allow access to the database tier. What should they implement?

   • AUse a single security group for both tiers and rely on IAM roles to control access.
   • BEncrypt the database and store the encryption keys in AWS KMS, but allow all traffic from the web tier.
   • CPlace the web tier in a public subnet and the database tier in a private subnet, and use security groups to allow only the web tier to access the database on the required port.
   • DPlace the web and database tiers in the same subnet but use security group rules to restrict traffic between them.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security operations team uses AWS Systems Manager OpsCenter to manage operational work items. They want to ensure that security findings from GuardDuty automatically create OpsItems and that responders can track the status of each incident. What should they configure?

   • AEnable OpsCenter and create a rule in Amazon EventBridge to send GuardDuty findings to OpsCenter as OpsItems.
   • BConfigure GuardDuty to send findings directly to OpsCenter using its built-in integration.
   • CCreate an OpsItem manually for each GuardDuty finding and assign it to a responder.
   • DUse AWS Config to detect GuardDuty findings and create OpsItems through the AWS Config console.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   A security engineer wants to deploy a service that continuously monitors AWS accounts for malicious activity and unauthorized behavior, such as crypto mining or unusual API calls. Which AWS service should the engineer deploy?

   • AAWS Config
   • BAWS CloudTrail
   • CAmazon GuardDuty
   • DAmazon Inspector
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company is preparing for a potential DDoS attack on its public-facing application. They want to use AWS Shield Advanced to provide enhanced protection and integrate with their incident response procedures. What should they configure to meet these requirements?

   • ACreate a Lambda function that automatically scales the application to absorb the attack.
   • BEnable Shield Advanced on the application's Elastic IP or CloudFront distribution, and create an AWS WAF rule to automatically block suspicious traffic.
   • CUse AWS Network Firewall to block all incoming traffic during an attack.
   • DEnable Shield Standard and configure AWS Config rules to detect DDoS attacks.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   A security architect wants to limit the impact of a security incident by isolating a compromised workload from the rest of the network. Which technique should the architect use?

   • ADisabling AWS CloudTrail
   • BPlacing all resources in a single subnet
   • CNetwork segmentation using subnets and security groups
   • DGranting all users administrative permissions
   Reveal Solution Discussion Select an answer first