Free Amazon Web Services SCS-C02 Practice Exam with Questions & Answers | Set: 9

Create an AWS Service Catalog portfolio in the organization's management account. Upload the CloudFormation template. Add the template to theportfolio's product list. Share the portfolio with the OIJ.

Use the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormationregistry. Publish the extension. In the OU, create an SCP that allows access to the extension.

Create an AWS Service Catalog portfolio in the organization's management account. Upload the CloudFormation template. Add the template to theportfolio's product list. Create an IAM role that has a trust policy that allows cross-account access to the portfolio for users in the OU accounts. Attach theAWSServiceCatalogEndUserFullAccess managed policy to the role.

Use the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormationregistry. Publish the extension. Share the extension with the OU

Use encrypted Amazon EBS volumes with Amazon default keys (IAM EBS)

Use server-side encryption with customer-provided keys (SSE-C)

Use server-side encryption with IAM KMS managed keys (SSE-KMS)

Use server-side encryption with Amazon S3 managed keys (SSE-S3)

• sgLB Allow port 80 traffic and port 443 traffic from 0 0 0 0/0

• sgWeb Allow port 80 traffic and port 443 traffic from sgLB

• sgDB Allow port 3306 traffic from sgWeb and sgBastion

• sgBastion Allow port 22 traffic from the corporate IP address range

• sgLB Allow port 80 traffic and port 443 traffic from 0 0 0 0/0

• sgWeb Allow port 80 traffic and port 443 traffic from sgLB

• sgDB Allow port 3306 traffic from sgWeb and sgLB

• sgBastion Allow port 22 traffic from the VPC IP address range

• sgLB Allow port 80 traffic and port 443 traffic from 0 0 0 0/0

• sgWeb Allow port 80 traffic and port 443 traffic from sgLB

• sgDB Allow port 3306 traffic from sgWeb and sgBastion

• sgBastion Allow port 22 traffic from the VPC IP address range

* sgLB: Allow port 80 traffic and port 443 traffic from 0.0.0.0/0

* sgWeb: Allow port 80 traffic and port 443 traffic from 0.0.0.0/0

* sgDB: Allow port 3306 traffic from sgWeb and sgBastion

* sgBastion: Allow port 22 traffic from the corporate IP address range

Create a new SCP in the marketing team's account. Configure the SCP to explicitly allow resource sharing.

Edit the existing SCP to add a Condition statement that excludes the marketing team's account.

Edit the existing SCP to include an Allow statement that specifies the marketing team's account.

Create an IAM permissions boundary policy to explicitly allow resource sharing. Attach the policy to IAM users in the marketing team's account.

Disable termination protection for the EC2 instance if termination protection has not been disabled.

Enable termination protection for the EC2 instance if termination protection has not been enabled.

Take snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to theEC2 instance.

Remove all snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.

Capture the EC2 instance metadata, and then tag the EC2 instance as under quarantine.

Immediately remove any entries in the EC2 instance metadata that contain sensitive information.

Use Amazon Athena to query the ALB logs by the request ID of the blocked request.

Use Amazon Athena to query the web ACL logs by the request ID of the blocked request.

Use CloudWatch Logs Insights to query the application logs by the request ID of the blocked request.

Use CloudWatch Logs Instghts to query the web ACL logs by the request ID of the blocked request.

Create an AWS Step Functions state machine that checks the resource type in the finding and adds an explicit Deny statement in the trust policy for the IAM role. Configure the state machine to publish a notification to an Amazon SNS topic.

Create an AWS Batch job that forwards any resource type findings to an AWS Lambda function. Configure the Lambda function to add an explicit Deny statement in the trust policy for the IAM role. Configure the AWS Batch job to publish a notification to an Amazon SNS topic.

In Amazon EventBridge, create an event rule that matches active IAM Access Analyzer findings and invokes AWS Step Functions for resolution.

In Amazon CloudWatch, create a metric filter that matches active IAM Access Analyzer findings and invokes AWS Batch for resolution.

Create an Amazon SQS queue. Configure the queue to forward a notification to the security team that an external principal has been granted access to the specific IAM role and has been blocked.

Create an Amazon SNS topic for external or cross-account access notices. Subscribe the security team's email addresses to the topic.

Update the Lambda function to add a TTL S3 flag to S3 objects. Create an S3 Lifecycle policy to expire objects that are older than 30 days by using the TTL S3 flag.

Create an S3 Lifecycle policy to expire objects that are older than 30 days. Update the Lambda function to add the TTL attribute in the DynamoDB table. Enable TTL on the DynamoDB table to expire entires that are older than 30 days based on the TTL attribute.

Create an S3 Lifecycle policy to expire objects that are older than 30 days and to add all prefixes to the S3 bucket. Update the Lambda function to delete entries that are older than 30 days.

Create an S3 Lifecycle policy to expire objects that are older than 30 days by using object tags. Update the Lambda function to delete entries that are older than 30 days.

In the security group of the EC2 instance, allow inbound ICMP traffic.

In the security group of the EC2 instance, allow outbound ICMP traffic.

In the VPC's NACL, allow inbound ICMP traffic.

In the VPC's NACL, allow outbound ICMP traffic.

Import new key material into the key. Attach the EBS volume.

Restore the EBS volume from a snapshot that was taken before the deletion of the key material.

Reimport the same key material lhat originally was imported into the key. Attach the EBS volume.

Create a new key. Import new key material. Attach the EBS volume.