Task 2.1: Design and Test an Incident Response Plan SCS-C03 Practice Questions (Page 9)

Questions 41–42

1. 41expert · medium

   A company is updating its incident response plan. The plan must ensure that responders can access the AWS account within 15 minutes of an incident, but the security team is concerned about standing privileges. They also want to test the plan without affecting production. The company uses AWS Organizations with multiple accounts. What is the BEST approach?

   • APre-provision IAM roles in each account with the necessary permissions, and use IAM Identity Center to allow responders to assume the roles on demand.
   • BCreate IAM users for each responder in the management account and attach the AdministratorAccess policy.
   • CCreate a break-glass IAM role in each account with full administrative access, and require two-factor authentication for assumption.
   • DUse IAM Identity Center with permission sets that grant administrative access, and require responders to request access through a ticketing system before assuming the role.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   A security engineer wants to ensure that an IAM role has only the permissions required to perform its job, reducing the potential impact if the role is compromised. Which principle should the engineer apply?

   • ASeparation of duties
   • BLeast privilege
   • CDefense in depth
   • DFail-open design
   Reveal Solution Discussion Select an answer first