Question 1

A company is building a secure solution that relies on an AWS Key Management Service (AWS KMS) customer managed key. The company wants to allow AWS Lambda to use the KMS key. However, the company wants to prevent Amazon EC2 from using the key. Which solution will meet these requirements?

Options :

A : Use IAM explicit deny for EC2 instance profiles and allow for Lambda roles.

B : Use a KMS key policy with kms:ViaService conditions to allow Lambda usage and deny EC2 usage.

C : Use aws:SourceIp and aws:AuthorizedService condition keys in the KMS key policy.

D : Use an SCP to deny EC2 and allow Lambda.

Answer: B

Question 2

A company uses an organization in AWS Organizations to manage multiple AWS accounts. The company wants to centrally give users the ability to access Amazon Q Developer. Which solution will meet this requirement?

Options :

A : Enable AWS IAM Identity Center and set up Amazon Q Developer as an AWS managed application.

B : Enable Amazon Cognito and create a new identity pool for Amazon Q Developer.

C : Enable Amazon Cognito and set up Amazon Q Developer as an AWS managed application.

D : Enable AWS IAM Identity Center and create a new identity pool for Amazon Q Developer.

Answer: A

Question 3

A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company's AWS resources. Which additional step will meet these requirements?

Options :

A : Update the S3 bucket policy to ensure that clients that use pre-signed URLs have the S3:Get* permission and the S3:List* permission to access S3 objects in the bucket.

B : Add a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the policy condition to restrict access based on the s3:ResourceTag/ClientId tag of each invoice. Tag each generated invoice with the ID of its corresponding client.

C : Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that has S3:GetObject permissions. Use the credentials to generate the pre-signed URLs.

D : Generate an access key and a secret key for an IAM user that has S3:GetObject permissions on the S3 bucket. Embed the keys into the script. Use the keys to generate the pre-signed URLs.

Answer: B

Question 4

A company is running a new workload across accounts in an organization in AWS Organizations. All running resources must have a tag of CostCenter, and the tag must have one of three approved values. The company must enforce this policy and must prevent any changes of the CostCenter tag to a non-approved value. Which solution will meet these requirements?

Options :

A : Use AWS Config custom policy rule and an SCP to deny non-approved aws:RequestTag/CostCenter values.

B : Use CloudTrail + EventBridge + Lambda to block creation.

C : Enable tag policies, define allowed values, enforce noncompliant operations, and use an SCP to deny creation when aws:RequestTag/CostCenter is null.

D : Enable tag policies and use EventBridge + Lambda to block changes.

Answer: C

Question 5

A company needs to scan all AWS Lambda functions for code vulnerabilities.

Options :

A : Use Amazon Macie.

B : Enable Amazon Inspector Lambda scanning.

C : Use GuardDuty and Security Hub.

D : Use GuardDuty Lambda Protection.

Answer: B

Confidently Practice Online with Free SCS-C03 Exam Cram

Buying Options: