Task 6.2: Implement a Secure and Consistent Deployment Strategy for Cloud Resources SCS-C03 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   A security engineer needs to deploy the same security group rules to multiple AWS accounts and regions. Which AWS service should they use to manage these deployments centrally?

   • AAWS Systems Manager
   • BAWS CloudFormation StackSets
   • CAWS Service Catalog
   • DAWS Config
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a common security practice when using third-party IaC tools like Terraform or Pulumi with AWS?

   • ARunning `terraform plan` and `terraform apply` manually on a developer's laptop
   • BStoring the state file in a public S3 bucket for easy access
   • CIntegrating the IaC tool with a CI/CD pipeline and using a dedicated IAM role for deployments
   • DUsing the root account credentials for the IaC tool to ensure it has full access
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A DevOps engineer is building a CI/CD pipeline for CloudFormation templates. The pipeline currently runs cfn-lint to check for syntax errors. The security team now wants to add a check that prevents the creation of IAM users with 'AdministratorAccess' policies. Which tool should be added to the pipeline?

   • AAWS Service Catalog
   • BAWS Config
   • CAWS Resource Access Manager
   • DCloudFormation Guard
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is a key benefit of centrally deploying security policies from a single source, such as AWS Firewall Manager?

   • AIt ensures consistent security configuration across all accounts and resources
   • BIt eliminates the need for any security monitoring
   • CIt provides a single dashboard for all security findings
   • DIt automatically patches all EC2 instances
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company uses Terraform to manage infrastructure across multiple AWS accounts. The security team wants to enforce a policy that all S3 buckets have versioning enabled and that no IAM user has an inline policy granting 's3:*' on 'arn:aws:s3:::*'. The team wants to enforce this before Terraform applies changes. Which approach is the MOST effective?

   • AUse AWS Config rules to detect non-compliant S3 buckets and IAM users after deployment and trigger auto-remediation.
   • BUse a policy-as-code tool like OPA or Sentinel in the CI pipeline to evaluate the Terraform plan against the security policies.
   • CUse a Terraform 'check' block to validate the configuration before apply.
   • DUse AWS CloudFormation Guard to validate the Terraform configuration files.
   Reveal Solution Discussion Select an answer first