Task 3.2: Design, Implement, and Troubleshoot Security Controls for Compute Workloads SCS-C03 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a benefit of integrating Amazon Inspector with Systems Manager for patch compliance?

   • AIt eliminates the need for security groups.
   • BIt provides a browser-based shell for instance access.
   • CIt provides a single view of patch compliance and vulnerability findings.
   • DIt automatically patches instances without any manual intervention.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A developer is writing a new AWS Lambda function and wants to get real-time suggestions on how to fix a potential security vulnerability in the code, such as a hardcoded AWS access key. The developer wants this feedback directly in their integrated development environment (IDE) before committing the code. Which AWS service or feature should they use?

   • AAWS Secrets Manager
   • BAmazon CodeGuru Reviewer
   • CAmazon Q Developer
   • DAmazon Inspector
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services company is required to deploy EC2 instances that meet internal security baselines. The security team has defined a set of approved packages, disabled services, and specific security agents that must be present on every instance. They want to automate the creation of these compliant images and ensure they are rebuilt monthly with the latest patches. Which solution should they use?

   • ALaunch an instance, manually install all required software, and create an AMI from it, repeating this process every month.
   • BUse EC2 Image Builder to define a pipeline that installs approved packages, disables unwanted services, and embeds security agents, with a monthly schedule for building and testing new AMIs.
   • CUse AWS Marketplace to subscribe to a third-party hardened AMI and rely on the vendor to update it monthly.
   • DCreate a golden AMI manually, then use AWS Systems Manager Patch Manager to apply patches to running instances each month.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following tools can be integrated into a CI/CD pipeline to discover security vulnerabilities in code?

   • AAWS Trusted Advisor
   • BAmazon CodeGuru Security
   • CAmazon GuardDuty
   • DAWS CloudTrail
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company has a policy that no EC2 instance should have SSH or RDP ports open to the internet. However, system administrators need a secure and auditable way to access instances for troubleshooting. They also want to avoid managing SSH keys. Which solution should they implement?

   • AConfigure AWS Systems Manager Session Manager for the instances and ensure they have the SSM Agent installed and an appropriate IAM instance profile.
   • BSet up a bastion host in a public subnet and require administrators to SSH into the bastion first.
   • COpen port 22 in the security group to the administrators' IP addresses and use standard SSH with key pairs.
   • DUse EC2 Instance Connect to push a temporary SSH key to the instance.
   Reveal Solution Discussion Select an answer first