Task 6.2: Implement a Secure and Consistent Deployment Strategy for Cloud Resources SCS-C03 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is adopting a multi-account strategy and wants to implement a tagging strategy to track costs and ownership. The finance team needs to allocate costs by department and project. The operations team needs to identify the owner of each resource for troubleshooting. What is the MOST effective tagging strategy?

   • AApply tags only to EC2 instances and S3 buckets, as these are the most common resources.
   • BApply mandatory tags for 'CostCenter', 'Department', 'Project', and 'Owner' to all resources, and enforce them with a policy.
   • CUse AWS Service Catalog to automatically add tags to all resources created through it.
   • DCreate a separate AWS account for each department to avoid the need for tagging.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company uses AWS Service Catalog to provision standardized EC2 instances for its developers. The company wants to automatically apply tags to all resources provisioned through Service Catalog to track the 'CostCenter' and 'Environment'. What is the MOST efficient way to achieve this?

   • AConfigure the Service Catalog product's CloudFormation template to include the tags as parameters, and require users to provide them.
   • BAsk developers to manually tag the resources after they are provisioned.
   • CUse AWS Config rules to add the tags after the resources are created.
   • DUse AWS Resource Access Manager to share the tags with the developers.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A security engineer is implementing a policy-as-code pipeline for CloudFormation deployments. The team uses AWS CloudFormation Stack Sets to deploy to multiple accounts. The security team wants to enforce a rule that prohibits the use of 't2.micro' instances in production accounts. The engineer has written a CloudFormation Guard rule. Where should the rule be enforced to ensure it is applied to all stack set deployments?

   • AIn the CI/CD pipeline that creates or updates the stack set, before the stack set operation is initiated.
   • BIn each target account using an AWS Config rule that checks for t2.micro instances.
   • CIn the stack set itself by adding a guard rule to the stack set's template.
   • DIn the management account using a Service Control Policy that denies t2.micro instance creation.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a common practice when using Infrastructure as Code to improve the security of cloud resource deployments?

   • AStoring IaC templates in a version control system and requiring code review before deployment
   • BUsing the same template for all environments without any parameterization
   • CSharing templates via email to ensure all team members have the latest version
   • DDeploying templates directly from a developer's local machine to avoid delays
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's central IT team has created a standardized, secure VPC architecture with a bastion host and specific security group rules. They want to allow application teams in different AWS accounts to launch this architecture themselves, but they do not want the teams to modify the underlying resources or create their own non-compliant versions. Which AWS service should the central IT team use?

   • AAWS Resource Access Manager
   • BAWS CloudFormation Stack Sets
   • CAWS Service Catalog
   • DAWS Organizations Service Control Policies
   Reveal Solution Discussion Select an answer first