Task 6.1: Develop a Strategy to Centrally Deploy and Manage AWS Accounts SCS-C03 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company's security team is responsible for managing the root user credentials for all member accounts in their AWS Organization. They want to implement a strategy that ensures root user passwords are strong, MFA is enabled, and there is a process for emergency access. What is the best practice for managing root user credentials?

   • ASet the root user password to a complex value and store it in a secure S3 bucket with restricted access.
   • BDisable the root user for all member accounts and rely solely on IAM users with administrative permissions.
   • CUse a centralized password manager to store root user passwords and MFA seeds, and document a break-glass procedure that involves the security team and AWS Support.
   • DCreate a shared root user password for all member accounts and enable MFA using a single hardware device.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company has a dedicated security team that manages a centralized security account. The company uses AWS Organizations and wants to delegate the management of AWS Security Hub to this security account so that the team can manage findings for all member accounts without needing access to the management account. What should the company do?

   • AUse AWS Control Tower to designate the security account as the delegated administrator for Security Hub.
   • BRegister the security account as a delegated administrator for Security Hub in the management account.
   • CCreate an IAM role in the management account that allows the security account to assume and manage Security Hub.
   • DEnable Security Hub in the security account and manually add all member accounts as linked accounts.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which AWS service is used to set up and govern a secure, multi-account AWS environment based on AWS best practices?

   • AAWS Service Catalog
   • BAWS Control Tower
   • CAWS Config
   • DAWS CloudTrail
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is planning to migrate to AWS and wants to set up a multi-account environment. They want to have separate accounts for development, testing, and production, and they want to centrally manage billing and apply security policies. What is the first step they should take?

   • ASet up AWS Control Tower first, which will automatically create the organization and accounts.
   • BCreate an SCP that defines the security policies and then create the accounts.
   • CCreate an AWS Organization and then create the development, testing, and production accounts as member accounts.
   • DCreate three separate AWS accounts and then link them together using consolidated billing.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which AWS service can have a delegated administrator account?

   • AAWS Identity and Access Management (IAM)
   • BAmazon S3
   • CAWS Security Hub
   • DAmazon EC2
   Reveal Solution Discussion Select an answer first