Task 3.2: Design, Implement, and Troubleshoot Security Controls for Compute Workloads SCS-C03 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An application running on an EC2 instance needs to read objects from a specific Amazon S3 bucket and write logs to Amazon CloudWatch Logs. The security team mandates that the instance not have any long-term AWS credentials stored on it. How should the instance be configured to meet this requirement?

   • ACreate an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.
   • BGenerate an access key and secret key for a dedicated IAM user and store them in a file on the instance.
   • CPlace the access keys in the user data script that runs at instance launch.
   • DUse AWS Secrets Manager to store the credentials and have the application retrieve them at runtime.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which principle should guide the configuration of execution roles for compute workloads?

   • AGrant only the permissions required for the workload to function.
   • BGrant full administrator access to simplify management.
   • CGrant permissions to all services in the account for flexibility.
   • DGrant permissions based on the user who deployed the workload.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A developer needs temporary SSH access to a specific EC2 instance to debug an application issue. The company requires that access be granted based on IAM permissions and that no long-term SSH keys be stored on the developer's machine. The instance is in a private subnet but can reach the internet through a NAT gateway. What is the most appropriate way to grant this access?

   • ACreate a new key pair, give the private key to the developer, and add the public key to the instance's `authorized_keys` file.
   • BUse AWS Systems Manager Session Manager instead, as it does not require SSH.
   • CUse EC2 Instance Connect to push a one-time SSH key to the instance for the duration of the session.
   • DAllow SSH access from the developer's IP address by modifying the security group and use the existing key pair.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the primary purpose of Amazon Q Developer in a security context?

   • ATo monitor network traffic for malicious activity.
   • BTo provide a browser-based shell for EC2 instances.
   • CTo help developers identify and remediate security issues in code and infrastructure as code.
   • DTo manage IAM roles and policies.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   How can you continuously validate that EC2 instances are compliant with patch requirements?

   • ABy using Amazon Inspector and Systems Manager to scan and report on patch compliance.
   • BBy using AWS Trusted Advisor to check for missing patches.
   • CBy manually checking each instance once a month.
   • DBy enabling AWS CloudTrail to log all patch activity.
   Reveal Solution Discussion Select an answer first