Task 6.2: Implement a Secure and Consistent Deployment Strategy for Cloud Resources SCS-C03 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company manages 40 AWS accounts in an AWS Organization. The security team must deploy a set of security group rules and IAM roles to every account in the organization, and the deployment must be repeatable and auditable. The team currently uses AWS CloudFormation templates stored in a central repository. What is the MOST operationally efficient way to deploy these resources consistently across all accounts?

   • AWrite a script that assumes a role in each account and calls the AWS CloudFormation CreateStack API individually for each account.
   • BCreate a CloudFormation stack set with the organization as the target, and deploy the stack instances from the management account.
   • CDeploy the template manually in each account using the AWS Management Console and record the deployment in a spreadsheet.
   • DCreate a single CloudFormation stack in the management account and use AWS Resource Access Manager to share the created resources with all member accounts.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   A security team wants to ensure that all CloudFormation templates used in their organization require encryption for Amazon EBS volumes. Which tool can they use to enforce this rule before deployment?

   • AAWS CloudFormation Guard
   • BAWS Trusted Advisor
   • CAWS Service Catalog
   • DAWS Config
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company uses AWS CloudFormation Stack Sets to deploy a baseline VPC and security groups to all accounts in an AWS Organization. The security team wants to add a new security group rule to the baseline. The team is concerned about the deployment failing in some accounts and wants to ensure that the update is applied consistently. What is the BEST way to manage this update?

   • AManually update the CloudFormation stack in each account using the console.
   • BUpdate the stack set template and use the 'Update stacks' operation with a failure tolerance and maximum concurrent accounts setting.
   • CUse AWS Firewall Manager to add the security group rule.
   • DCreate a new stack set with the updated template and delete the old one.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security team wants to ensure that all AWS resources are deployed with the same security configurations, such as security groups and IAM roles, every time. Which approach best supports this goal?

   • ACreating a golden AMI that includes all security configurations
   • BUsing the AWS Management Console to manually create resources each time
   • CWriting a script that uses AWS CLI commands to create resources
   • DDefining infrastructure in a declarative template and using an IaC service to deploy it
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a best practice when designing a tagging strategy for AWS resources?

   • AUse a consistent set of tag keys across all resources, such as Environment, Owner, and CostCenter
   • BUse different tag keys for each resource type to avoid conflicts
   • CTag only production resources to reduce overhead
   • DUse tag values that are unique to each individual resource
   Reveal Solution Discussion Select an answer first