Task 6.1: Develop a Strategy to Centrally Deploy and Manage AWS Accounts SCS-C03 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the purpose of a break-glass procedure for root user accounts?

   • ATo provide emergency access to root user accounts when normal access methods fail.
   • BTo monitor root user activity.
   • CTo automate the rotation of root user passwords.
   • DTo prevent all access to root user accounts.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the difference between mandatory and elective controls in AWS Control Tower?

   • AMandatory controls are only for management accounts; elective controls are for member accounts.
   • BMandatory controls are free; elective controls incur additional charges.
   • CMandatory controls are implemented as SCPs; elective controls are implemented as AWS Config rules.
   • DMandatory controls are always enabled and cannot be disabled; elective controls are optional and can be enabled or disabled.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company is planning to use AWS Control Tower to manage its multi-account environment. The security team wants to use a delegated administrator account for AWS Security Hub. They have already set up Control Tower and have a security OU. What is the correct way to designate the delegated administrator for Security Hub?

   • AEnable Security Hub in the security account and then use the Security Hub console to add all member accounts.
   • BUse the AWS Organizations console to register the security account as a delegated administrator for Security Hub.
   • CCreate an SCP that grants the security account permission to manage Security Hub for all accounts.
   • DUse the Control Tower console to designate the security account as the delegated administrator for Security Hub.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key requirement for a break-glass procedure to be effective?

   • AIt must be automated to avoid human error.
   • BIt must be tested only during actual emergencies.
   • CIt must be kept secret from all employees.
   • DIt must be documented and accessible to authorized personnel.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How can you centrally manage AWS Security Hub across multiple accounts?

   • ABy using a delegated administrator and enabling cross-account aggregation.
   • BBy enabling Security Hub in each account individually.
   • CBy creating an IAM role in each account.
   • DBy using AWS Config rules.
   Reveal Solution Discussion Select an answer first