Task 3.2: Design, Implement, and Troubleshoot Security Controls for Compute Workloads SCS-C03 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   How does EC2 Instance Connect authorize SSH access to an instance?

   • ABy using IAM policies to control which users can push a temporary SSH key.
   • BBy using the instance's security group to allow all SSH traffic.
   • CBy using the root user credentials of the AWS account.
   • DBy using a shared password stored in Systems Manager Parameter Store.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A development team is building a containerized application and wants to ensure the container images are secure before they are deployed to Amazon ECS. They currently use a Dockerfile that starts from the `ubuntu:latest` base image and installs many development tools. The security team requires that images be scanned for vulnerabilities and that the attack surface be minimized. What should the team do?

   • AScan the image once with Amazon Inspector after it is deployed to ECS and fix any issues found in the next release.
   • BUse a multi-stage build to compile the application in a full image and copy only the runtime artifacts to a minimal base image, but do not scan the final image.
   • CSwitch to a smaller base image like `alpine`, remove unnecessary packages from the Dockerfile, and integrate Amazon Inspector image scanning into the CI/CD pipeline.
   • DContinue using `ubuntu:latest` but run `apt-get upgrade` in the Dockerfile to ensure all packages are up to date.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the purpose of guardrails for generative AI applications?

   • ATo automatically patch the AI model's underlying infrastructure.
   • BTo provide a firewall for the AI application's network traffic.
   • CTo manage IAM roles for the AI service.
   • DTo enforce content policies and prevent harmful outputs.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which AWS service can scan EC2 instances, container images, and Lambda functions for known vulnerabilities?

   • AAmazon Inspector
   • BAWS Config
   • CAWS Trusted Advisor
   • DAmazon GuardDuty
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following is a security feature of Amazon Q Developer?

   • AIt can scan code for security vulnerabilities and suggest fixes.
   • BIt provides a firewall for web applications.
   • CIt blocks all inbound traffic to instances.
   • DIt automatically patches EC2 instances.
   Reveal Solution Discussion Select an answer first