Task 3.2: Design, Implement, and Troubleshoot Security Controls for Compute Workloads SCS-C03 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a key capability of GuardDuty runtime monitoring?

   • ADetecting anomalous behavior within compute workloads.
   • BProviding a browser-based shell for instance access.
   • CEnforcing patch compliance on EC2 instances.
   • DScanning for software vulnerabilities in container images.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the purpose of a service role in AWS?

   • ATo grant permissions to an AWS service so it can access other AWS resources on your behalf.
   • BTo store encrypted secrets for applications.
   • CTo provide a login session for a human user in the AWS Management Console.
   • DTo define the network ACL rules for a VPC.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company is building a generative AI application that uses a large language model (LLM) to answer customer questions. They are concerned about prompt injection attacks where a user could manipulate the model into performing unintended actions or revealing sensitive information. What is the most effective way to mitigate this risk?

   • ARestrict the LLM's access to the internet to prevent it from being manipulated.
   • BImplement input validation and output filtering, and use a guardrail service like Amazon Bedrock Guardrails to enforce content policies.
   • CRely solely on the LLM's built-in safety features to detect and block malicious prompts.
   • DUse a more powerful LLM that is less susceptible to prompt injection.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security engineer is designing a hardened Amazon EC2 AMI. Which set of actions aligns with the principle of reducing the attack surface?

   • ADisable all network access and remove all management agents to prevent external threats.
   • BUse the latest Amazon Linux AMI without modifications to ensure it is already hardened.
   • CInstall all available packages and enable all services to ensure maximum functionality.
   • DRemove unnecessary packages, disable unused services, and embed security controls such as Systems Manager.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which AWS service is specifically designed to help build and maintain hardened AMIs through automated pipelines?

   • AEC2 Image Builder
   • BAWS Systems Manager Patch Manager
   • CAWS Config
   • DAmazon Inspector
   Reveal Solution Discussion Select an answer first