Task 6.2: Implement a Secure and Consistent Deployment Strategy for Cloud Resources SCS-C03 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of AWS CloudFormation Guard?

   • ATo monitor deployed resources for configuration drift
   • BTo deploy CloudFormation stacks across multiple accounts
   • CTo lint CloudFormation templates for syntax errors
   • DTo validate CloudFormation templates against policy rules
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A security team wants to enforce the same security group rules across all accounts in an AWS Organization. Which AWS service is designed to centrally deploy and manage such policies?

   • AAWS Config
   • BAWS Firewall Manager
   • CAWS Service Catalog
   • DAWS CloudTrail
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a prerequisite for using AWS Firewall Manager to manage security policies across an organization?

   • AThe organization must have AWS Organizations enabled with all features
   • BAll accounts must be in the same AWS region
   • CEach account must have its own Firewall Manager administrator
   • DThe organization must use AWS Control Tower
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which AWS service allows you to share subnets across accounts without needing to duplicate them?

   • AAWS Transit Gateway
   • BAWS Service Catalog
   • CAWS Resource Access Manager (RAM)
   • DAWS CloudFormation StackSets
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A startup uses Terraform to manage its AWS infrastructure. The team wants to ensure that all resources are tagged with the 'CostCenter' tag and that no security group allows inbound SSH from 0.0.0.0/0. They want to enforce these rules before Terraform applies changes. What is the BEST approach?

   • AAdd a local-exec provisioner in the Terraform configuration that runs a shell script to check the tags and security group rules.
   • BUse AWS CloudFormation Guard to validate the Terraform configuration files.
   • CRely on AWS Config rules to detect and remediate non-compliant resources after they are created.
   • DUse a Terraform provider-level validation or a policy-as-code tool like OPA or Sentinel in the CI pipeline to check the Terraform plan.
   Reveal Solution Discussion Select an answer first