Task 3.2: Design, Implement, and Troubleshoot Security Controls for Compute Workloads SCS-C03 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   How does an EC2 instance obtain temporary AWS credentials for API calls?

   • ABy hardcoding the AWS secret key in the application code.
   • BBy embedding an IAM user's access key in the AMI.
   • CBy using an instance profile that is associated with an IAM role.
   • DBy using the root user credentials of the AWS account.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A company manages a fleet of Windows and Linux EC2 instances. The security team wants to automate the installation of security patches on a regular schedule, but they must ensure that patches are applied only during a predefined maintenance window to avoid impacting business operations. Which AWS service and feature should they use?

   • AAWS OpsWorks for Chef Automate to run a recipe that updates all packages.
   • BAWS Systems Manager Run Command to run a patch command immediately on all instances.
   • CAWS Systems Manager Patch Manager with a patch baseline and a maintenance window.
   • DA custom script run via Amazon EC2 Instance Connect that executes `yum update` or `Windows Update`.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which component of EC2 Image Builder defines the software and security configurations to be applied to an image?

   • ADistribution configuration
   • BPipeline
   • CInfrastructure configuration
   • DRecipe
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company is deploying a generative AI chatbot that interacts with customers. The security team wants to ensure the chatbot does not generate harmful or inappropriate content, and that it does not leak sensitive internal data. They also want to be able to audit the interactions. Which AWS service should they use to enforce these content policies?

   • AAmazon Bedrock Guardrails
   • BAWS CloudTrail
   • CAWS WAF
   • DAmazon Macie
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company wants to use AWS Systems Manager Session Manager to provide secure access to their EC2 instances. They have installed the SSM Agent and attached an IAM instance profile that allows `ssm:StartSession`. However, when an administrator tries to start a session, they receive an error. The instances are in a VPC with no internet gateway, and the company does not want to use a NAT gateway. What should they do to resolve this issue?

   • AAdd a route to the internet gateway in the instance's route table.
   • BUse EC2 Instance Connect instead, as it does not require network connectivity.
   • CCreate a VPC interface endpoint for AWS Systems Manager (ssm) and ensure the instances can route to it.
   • DEnsure the instance has a public IP address.
   Reveal Solution Discussion Select an answer first