Task 3.2: Design, Implement, and Troubleshoot Security Controls for Compute Workloads SCS-C03 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What type of findings does Amazon Inspector primarily produce?

   • AFindings about IAM policy misconfigurations.
   • BFindings about suspicious API calls.
   • CFindings about software vulnerabilities and network exposure.
   • DFindings about cost optimization opportunities.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A company runs a microservices application on Amazon ECS with the Fargate launch type. One service needs to read from an Amazon S3 bucket and publish messages to an Amazon SNS topic. The security team wants to ensure that the service has the minimum permissions necessary. They have created an IAM role for the task. What is the correct way to associate this role with the ECS service?

   • AAttach the IAM role directly to the ECS service using the AWS Management Console.
   • BUse the ECS service's default execution role for the application's permissions.
   • CSpecify the task role in the task definition, and the ECS service will use it for the containers in the task.
   • DCreate an instance profile and attach it to the Fargate task.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of an EC2 Image Builder pipeline?

   • ATo provide a browser-based shell for EC2 instances.
   • BTo automate the creation, testing, and distribution of hardened AMIs and container images.
   • CTo manage IAM roles for EC2 instances.
   • DTo scan running EC2 instances for vulnerabilities in real time.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company runs a serverless application using AWS Lambda. The Lambda function needs to process messages from an Amazon SQS queue and then write the results to an Amazon DynamoDB table. The security team requires that the function have the minimum permissions necessary to perform its task. What should the developer configure?

   • AUse the Lambda function's default execution role, which grants broad permissions to all AWS services.
   • BAttach the `AmazonSQSFullAccess` and `AmazonDynamoDBFullAccess` managed policies to the Lambda function's execution role.
   • CCreate a custom IAM policy that allows only the specific SQS actions (e.g., `sqs:ReceiveMessage`, `sqs:DeleteMessage`) on the specific queue and the specific DynamoDB actions (e.g., `dynamodb:PutItem`) on the specific table, and assign it to the function's execution role.
   • DEmbed the AWS credentials of a powerful IAM user directly in the Lambda function's environment variables.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of EC2 Instance Connect?

   • ATo provide a browser-based shell without any SSH client.
   • BTo provide a VPN connection to the VPC.
   • CTo provide temporary SSH access to EC2 instances using IAM-based authorization.
   • DTo automatically patch instances before SSH access is granted.
   Reveal Solution Discussion Select an answer first