Task 6.2: Implement a Secure and Consistent Deployment Strategy for Cloud Resources SCS-C03 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is the primary purpose of cfn-lint?

   • ATo enforce security policies on CloudFormation templates
   • BTo statically analyze CloudFormation templates for syntax and resource specification issues
   • CTo deploy CloudFormation stacks
   • DTo monitor deployed resources for compliance
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which AWS service allows you to centrally configure and manage AWS WAF rules across all accounts in an AWS Organization?

   • AAWS WAF Classic
   • BAWS Firewall Manager
   • CAWS Shield Advanced
   • DAWS Network Firewall
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A DevOps engineer is building a CI/CD pipeline that deploys AWS CloudFormation templates. The security team requires that no S3 bucket in any template be publicly accessible, and that all EC2 instances have the 'Environment' tag. The engineer wants to catch violations before the templates are deployed. Which combination of tools should be used in the pipeline?

   • ARun CloudFormation Guard only, as it can also validate template syntax and resource specifications.
   • BRun cfn-lint only, and add a custom rule to check for public S3 buckets and required tags.
   • CUse AWS Config managed rules in the pipeline to check the deployed resources after creation.
   • DRun cfn-lint to check for syntax errors, then run CloudFormation Guard rules to enforce the security policies.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A developer wants to catch errors in a CloudFormation template before submitting it for deployment. Which tool should they use?

   • AAWS CloudFormation Guard
   • BAWS Config
   • CAWS Service Catalog
   • Dcfn-lint
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company has a centralized networking account that hosts a shared transit gateway and a set of subnets. Multiple application accounts need to use these shared resources to connect to a central VPC. The company wants to avoid duplicating the transit gateway and subnets in each account. What is the MOST efficient way to share these resources?

   • AUse AWS Service Catalog to provision a new transit gateway and subnets in each account.
   • BCreate a CloudFormation stack set to deploy a copy of the transit gateway and subnets in each application account.
   • CEstablish a VPC peering connection between the central account and each application account.
   • DUse AWS Resource Access Manager to share the transit gateway and subnets with the application accounts.
   Reveal Solution Discussion Select an answer first