Amazon AWS Certified Security — Speciality SCS-C02 Exam Dumps and Practice Test Questions Set 11 Q151-165 - Certbolt

Visit here for our full Amazon AWS Certified Security — Specialty SCS-C02 exam dumps and practice test questions.

Question151:

A multinational enterprise plans to deploy a highly confidential research dataset in Amazon S3. Security requirements include encryption at rest with customer-managed KMS keys, immutability to prevent accidental or malicious deletions, least-privilege access control, multi-region audit logging, and real-time alerts for policy violations. Which solution satisfies these requirements?

A) Enable SSE-S3 encryption and rely on administrators to enforce KMS usage manually.
B) Implement S3 Object Lock in compliance mode, enforce Service Control Policies (SCPs) to mandate customer-managed KMS key usage, configure EventBridge rules for automated remediation, apply least-privilege bucket policies, and consolidate CloudTrail logs into a centralized audit account.
C) Encrypt objects manually after upload and rely on developers to monitor compliance.
D) Enable versioning and manually review object deletions and modifications.

Answer:
B

Explanation:

Option A, relying on SSE-S3 encryption and manual enforcement of KMS usage, does not provide enterprise-grade security. SSE-S3 encrypts data at rest but does not prevent deletions or modifications. Manual enforcement introduces the risk of human error, inconsistent application across accounts or regions, and limited operational scalability. Furthermore, SSE-S3 does not provide the automated monitoring or real-time alerts necessary for immediate detection of policy violations. While simple to implement, this approach cannot meet the stringent regulatory, operational, and security requirements of a multinational enterprise handling highly confidential research data.

Option B is the comprehensive solution that meets all stated requirements. S3 Object Lock in compliance mode enforces immutability, ensuring that objects cannot be deleted or altered during the retention period, protecting against both accidental and malicious deletions. Service Control Policies (SCPs) mandate that only customer-managed KMS keys are used for encryption, enforcing organizational encryption policies consistently across accounts. EventBridge rules allow for real-time detection of policy violations and can trigger automated remediation workflows, ensuring that misconfigurations are corrected immediately. Bucket policies enforce least-privilege access, limiting object access to only authorized users and reducing insider threat risks. Consolidated CloudTrail logs across multiple regions provide centralized auditing, operational oversight, and forensic readiness, enabling the enterprise to meet regulatory compliance requirements. Preventive, detective, and corrective controls are fully integrated, ensuring the solution is both robust and scalable.

Option C, which involves manual encryption and developer monitoring, is reactive and operationally intensive. It leaves windows of vulnerability during the upload process and relies heavily on human intervention, increasing the risk of misconfiguration and non-compliance. Option D, enabling versioning with manual review, allows recovery of deleted objects but does not prevent deletions or modifications proactively. Manual audits at enterprise scale are impractical and cannot ensure continuous compliance or immediate detection of policy violations.

Question152:

A healthcare organization is migrating sensitive patient records to Amazon RDS. Security requirements include encryption at rest using customer-managed KMS keys, encryption in transit, identity-based access control, automated credential rotation, and centralized auditing of all database operations and configuration changes. Which solution is most appropriate?

A) Enable RDS encryption with AWS-managed keys, grant developers broad access, and enforce SSL/TLS.
B) Use customer-managed KMS keys for encryption, enforce SSL/TLS, implement IAM database authentication, enable automated credential rotation with AWS Secrets Manager, and configure CloudTrail logging.
C) Store database credentials in environment variables and rely on default encryption.
D) Enable point-in-time recovery and manually review logs periodically.

Answer:
B

Explanation:

Option A offers encryption at rest using AWS-managed keys and SSL/TLS for transit security. However, granting broad access to developers violates the principle of least privilege, potentially exposing sensitive patient records. AWS-managed keys do not allow detailed control over key lifecycle, rotation, or auditing. The lack of automated credential management and centralized auditing means operational oversight is limited, leaving the system vulnerable to insider threats, misconfiguration, or compliance violations. For healthcare data, where regulatory standards are stringent, this solution is insufficient.

Option B provides a complete, enterprise-grade security solution. Customer-managed KMS keys enforce encryption at rest with organizational control, key rotation, and auditability. SSL/TLS encrypts data in transit, protecting it from interception or tampering. IAM database authentication ensures identity-based access control, applying least-privilege principles and eliminating the need for static credentials. AWS Secrets Manager automates credential rotation, reducing exposure of sensitive credentials and operational workload. CloudTrail provides centralized auditing and logging of database operations and configuration changes, enabling compliance reporting, monitoring, and forensic analysis. The integration of preventive controls (encryption, IAM authentication), detective controls (CloudTrail), and corrective mechanisms (automated rotation) creates a fully secure and operationally efficient system.

Option C, storing credentials in environment variables with default encryption, exposes sensitive information, lacks automated rotation, centralized audit, and preventive access controls, making it inadequate for healthcare requirements. Option D, enabling point-in-time recovery and manually reviewing logs, is reactive and labor-intensive, failing to prevent unauthorized access or misconfigurations proactively.

Option B meets all stated requirements, ensuring sensitive patient records are encrypted, access-controlled, auditable, and operationally secure, while supporting compliance with healthcare regulations.

Question153:

A financial institution needs to securely store high-volume transactional data in Amazon S3. Security requirements include prevention of accidental or malicious deletions, immutability enforcement, mitigation of insider threats, and centralized audit logging. Which solution is most suitable?

A) Enable S3 versioning and rely on developers to prevent deletions.
B) Use S3 Object Lock in compliance mode, enforce bucket policies restricting access, and enable CloudTrail logging.
C) Maintain manual backups and track deletions manually.
D) Encrypt objects using SSE-S3 and allow developers to manage access manually.

Answer:
B

Explanation:

Option A, enabling versioning, provides the ability to recover previous versions but does not prevent deletions or modifications proactively. Relying on developers for enforcement is error-prone and does not scale to enterprise needs. Versioning alone does not enforce immutability or mitigate insider threats, leaving critical financial data vulnerable.

Option B provides a comprehensive enterprise-grade solution. S3 Object Lock in compliance mode enforces immutability, ensuring that objects cannot be deleted or altered during the retention period. Bucket policies enforce least-privilege access, mitigating insider threats by restricting operations to authorized personnel. CloudTrail logging centralizes auditing and provides visibility into all S3 operations, supporting regulatory compliance, forensic investigations, and operational oversight. Event-driven solutions like EventBridge can enable real-time monitoring and automated remediation for any policy violations. Together, preventive, detective, and corrective controls provide a secure, scalable, and auditable storage environment for highly sensitive financial transactions.

Option C, manual backups and deletion tracking, is reactive, labor-intensive, and operationally impractical for high-volume enterprise data. Option D, SSE-S3 encryption with manual access control, protects confidentiality but does not enforce immutability, provide automated monitoring, or centralize audit logging, leaving significant compliance gaps.

Option B integrates encryption, immutability, access control, automated monitoring, and centralized auditing, providing a robust and compliant solution for enterprise financial data storage.

Question154:

A healthcare provider uses AWS Lambda functions to process sensitive patient data. Security policies require that Lambda invocations occur only through approved API Gateway endpoints and that all invocations are auditable. Which solution meets these requirements?

A) Allow all IAM users to invoke Lambda functions and rely on logging.
B) Attach resource-based policies to Lambda functions restricting invocation to approved API Gateway principals and enable CloudTrail logging.
C) Store invocation secrets in environment variables for developers.
D) Protect Lambda functions with API keys and rely on developers not to share them.

Answer:
B

Explanation:

Option A allows unrestricted Lambda invocation, relying solely on logging for auditing. This is insufficient for sensitive healthcare data as it does not prevent unauthorized access and violates regulatory compliance requirements. Option C, using environment variables for invocation secrets, is insecure and provides no preventive or auditable controls. Option D relies on API keys and developer discipline, which is operationally unreliable, cannot be enforced centrally, and is unsuitable for regulated environments.

Option B provides a robust solution. Resource-based policies restrict Lambda invocations to approved API Gateway principals, enforcing preventive access control. CloudTrail captures all invocation events, enabling centralized auditing, monitoring, and forensic analysis. Preventive (resource policies) and detective (CloudTrail) controls together ensure that only authorized endpoints invoke Lambda functions and that all activities are auditable. This solution aligns with enterprise security, operational efficiency, and regulatory compliance requirements for sensitive healthcare workloads.

Question155:

A company runs multiple EC2 instances that need access to sensitive internal APIs. Security requirements include least-privilege access, centralized credential management, automated secret rotation, and auditable access logs. Which solution meets these requirements?

A) Store API keys in environment variables and rotate manually.
B) Use AWS Systems Manager Parameter Store with SecureString parameters, assign IAM roles to EC2 instances, enable automated rotation, and monitor access with CloudTrail.
C) Hard-code credentials in applications and review logs weekly.
D) Use long-lived IAM user credentials for each EC2 instance.

Answer:
B

Explanation:

Option A exposes credentials in environment variables, lacks automated rotation, and does not provide centralized audit or preventive controls. Option C, hard-coded credentials, is insecure, difficult to rotate, and operationally challenging. Option D uses long-lived IAM credentials, which increases the risk of compromise and administrative overhead for rotation and auditing.

Option B provides a secure, automated, and auditable solution. SecureString parameters in Parameter Store encrypt credentials and enforce access control. IAM roles assigned to EC2 instances implement least-privilege access, ensuring only authorized instances can retrieve credentials. Automated rotation reduces exposure risk and operational overhead. CloudTrail captures all access events, enabling centralized auditing, monitoring, and forensic analysis. Preventive, detective, and corrective controls are integrated, delivering secure, operationally efficient, and compliant access to sensitive APIs.

Question156:

A financial services company wants to enforce strict encryption standards for all Amazon S3 buckets storing sensitive client data. Security requirements include mandatory use of customer-managed KMS keys, prevention of bucket-level public access, monitoring compliance with real-time alerts, and centralized auditing across multiple AWS accounts. Which solution best satisfies these requirements?

A) Enable SSE-S3 encryption, manually check bucket policies, and rely on administrators to enforce KMS usage.
B) Apply Service Control Policies (SCPs) to enforce customer-managed KMS key usage, enable Block Public Access settings on all accounts, configure AWS Config rules for compliance monitoring with EventBridge notifications, and centralize CloudTrail logs in a designated audit account.
C) Encrypt objects manually post-upload and use CloudWatch alarms for monitoring.
D) Rely on default AWS encryption and periodic manual audits of bucket access policies.

Answer:
B

Explanation:

Option A relies on SSE-S3 encryption and manual policy checks. While SSE-S3 provides encryption at rest, it does not allow the company to enforce key ownership, track usage, or ensure automated rotation. Manual enforcement of KMS usage is error-prone, does not scale across multiple accounts, and lacks real-time monitoring capabilities. Public access prevention is dependent on administrators correctly configuring bucket policies, introducing operational risk. Manual audits and human intervention can result in delayed detection of misconfigurations or security violations, leaving sensitive client data vulnerable to insider threats or accidental exposure.

Option B is the comprehensive solution aligning with all stated requirements. Service Control Policies (SCPs) enforce that all buckets in the organization use customer-managed KMS keys, centralizing control over encryption standards and enabling auditability. AWS Block Public Access settings prevent unintended public exposure at both the account and bucket levels, enforcing preventive security. AWS Config rules continuously evaluate bucket configurations against organizational policies, with EventBridge enabling real-time notifications of violations for immediate remediation. Consolidated CloudTrail logs allow centralized auditing across multiple accounts and regions, ensuring full visibility for compliance reporting, forensic investigations, and operational oversight. This solution integrates preventive, detective, and corrective controls, providing a secure, scalable, and auditable framework for sensitive client data stored in S3, meeting both operational and regulatory requirements.

Option C, manual encryption post-upload with CloudWatch alarms, is reactive and operationally intensive. It depends on human intervention, lacks automated enforcement of encryption standards, and cannot guarantee real-time compliance monitoring across multiple accounts. Option D, relying on default encryption and periodic manual audits, leaves the organization exposed to potential misconfigurations, lacks automation, and does not provide centralized audit capability, which is essential for multinational compliance.

Option B satisfies all preventive, detective, and corrective requirements, providing enterprise-grade security for sensitive client data in Amazon S3, combining automated enforcement, monitoring, and centralized auditing into a scalable, operationally efficient framework.

Question157:

A healthcare organization needs to process sensitive patient records using Amazon RDS while ensuring compliance with regulatory requirements. Security requirements include encryption at rest with customer-managed KMS keys, encryption in transit, identity-based access control, automated credential rotation, and centralized auditing of database operations. Which solution best meets these requirements?

A) Enable RDS encryption with AWS-managed keys, grant broad access to developers, and enforce SSL/TLS.
B) Use customer-managed KMS keys for encryption, enforce SSL/TLS, implement IAM database authentication, enable automated credential rotation with AWS Secrets Manager, and configure CloudTrail logging.
C) Store database credentials in environment variables and rely on default encryption.
D) Enable point-in-time recovery and manually review logs periodically.

Answer:
B

Explanation:

Option A, while providing encryption at rest with AWS-managed keys and SSL/TLS for in-transit encryption, is insufficient for highly sensitive patient records. Granting broad access to developers violates the principle of least privilege, increasing the risk of unauthorized access or accidental exposure. AWS-managed keys provide minimal control over key rotation and auditing, leaving gaps in operational and regulatory compliance. Without automated credential rotation and centralized auditing, detecting and mitigating security incidents is challenging.

Option B delivers a holistic, enterprise-ready solution. Customer-managed KMS keys enforce encryption at rest under organizational control, with the ability to audit key usage and rotate keys regularly. SSL/TLS protects data in transit between clients and RDS, maintaining confidentiality and integrity. IAM database authentication ensures identity-based access control and least-privilege enforcement, reducing insider risk. AWS Secrets Manager automates credential rotation, limiting exposure of sensitive credentials and simplifying operational management. CloudTrail logging centralizes auditing of all database operations and configuration changes, supporting regulatory compliance, forensic analysis, and operational oversight. The integration of preventive controls (encryption, IAM authentication), detective controls (CloudTrail), and corrective mechanisms (automated credential rotation) ensures a secure, compliant, and operationally efficient database environment.

Option C, storing credentials in environment variables with default encryption, exposes sensitive data and lacks automated credential rotation, centralized auditing, and preventive access controls. Option D, enabling point-in-time recovery and manual log review, is reactive, labor-intensive, and fails to enforce preventive controls, leaving the system vulnerable to misconfigurations or unauthorized access.

Option B satisfies all operational, preventive, and compliance requirements, ensuring sensitive patient data is securely encrypted, access-controlled, auditable, and managed efficiently.

Question158:

A financial institution requires a solution to protect sensitive transaction logs stored in Amazon S3. Security requirements include preventing accidental or malicious deletions, enforcing immutability, mitigating insider threats, and ensuring centralized auditing. Which solution is most appropriate?

A) Enable S3 versioning and rely on developers to prevent deletions.
B) Use S3 Object Lock in compliance mode, enforce bucket policies to restrict access, and enable CloudTrail logging.
C) Maintain manual backups and track deletions manually.
D) Encrypt objects using SSE-S3 and allow developers to manage access manually.

Answer:
B

Explanation:

Option A, enabling versioning and relying on developers, provides limited recovery capabilities but does not proactively prevent deletions or modifications. Relying on human intervention introduces operational risk and does not scale effectively for enterprise requirements. Versioning alone does not enforce immutability or address insider threats adequately.

Option B provides a comprehensive enterprise solution. S3 Object Lock in compliance mode enforces immutability, preventing deletion or modification of transaction logs during the retention period. Bucket policies restrict access to authorized users only, mitigating insider threats. CloudTrail logging centralizes auditing, offering full visibility into object operations, supporting regulatory compliance, operational oversight, and forensic investigations. Integration with event-driven workflows like EventBridge allows real-time detection of policy violations and automated remediation, ensuring proactive security. Preventive, detective, and corrective controls are fully integrated, providing robust, scalable, and auditable protection for highly sensitive financial transaction data.

Option C, manual backups and deletion tracking, is reactive, labor-intensive, and error-prone, making it operationally inefficient for high-volume data. Option D, SSE-S3 encryption with manual access control, secures confidentiality but does not enforce immutability, automated monitoring, or centralized auditing, leaving compliance and insider threat gaps.

Option B satisfies all preventive, detective, and corrective requirements, providing a secure, compliant, and operationally efficient solution for storing sensitive financial transaction logs in Amazon S3.

Question159:

A healthcare provider uses AWS Lambda to process sensitive patient data. Security policies require that Lambda functions are invoked only through approved API Gateway endpoints and that all invocations are auditable. Which solution meets these requirements?

A) Allow all IAM users to invoke Lambda functions and rely on logging.
B) Attach resource-based policies to Lambda functions allowing invocation only from approved API Gateway principals and enable CloudTrail logging.
C) Store invocation secrets in environment variables for developers.
D) Protect Lambda functions with API keys and rely on developers not to share them.

Answer:
B

Explanation:

Option A, allowing unrestricted Lambda invocation and relying on logging, is insufficient for regulated healthcare data because it does not prevent unauthorized access. Option C, storing secrets in environment variables, is insecure and provides no automated enforcement or centralized auditing. Option D, using API keys and relying on developer discipline, is operationally unreliable, non-scalable, and does not provide full auditability.

Option B is the enterprise-grade solution. Resource-based policies enforce preventive access control by restricting Lambda invocations to approved API Gateway principals. CloudTrail logging provides centralized, auditable records of all Lambda invocations, supporting regulatory compliance, monitoring, and forensic analysis. By combining preventive (resource-based policies) and detective (CloudTrail) controls, the solution ensures that Lambda functions process sensitive patient data only through authorized channels, maintaining both security and compliance. This approach meets organizational, operational, and regulatory requirements for healthcare workloads.

Question160:

A company operates multiple EC2 instances that require access to internal APIs containing sensitive data. Security requirements include least-privilege access, centralized credential management, automated secret rotation, and auditable access logs. Which solution satisfies these requirements?

Answer:
B

Explanation:

Option A exposes API keys in environment variables, lacks automated rotation, and provides no centralized auditing or preventive access controls. Option C, hard-coding credentials, is insecure, complicates rotation, and cannot enforce centralized monitoring. Option D, relying on long-lived IAM credentials, increases exposure risk and administrative overhead.

Option B offers a secure, automated, and auditable approach. Parameter Store SecureString parameters encrypt API keys and restrict access to authorized IAM roles. Assigning IAM roles to EC2 instances enforces least-privilege access, ensuring only authorized instances can retrieve credentials. Automated rotation minimizes exposure risk and operational burden. CloudTrail logs provide centralized auditing and monitoring of all access events, enabling forensic analysis and compliance verification. The integration of preventive, detective, and corrective controls ensures secure, operationally efficient, and compliant access to internal APIs for EC2 instances, aligning with enterprise and regulatory standards.

Question161:

A multinational enterprise is moving sensitive intellectual property to Amazon S3. The organization requires that all objects are encrypted with customer-managed KMS keys, deletions are prevented for a retention period, unauthorized access is blocked, and centralized audit logging is enforced. Which solution meets all these requirements?

A) Enable SSE-S3 encryption and rely on administrators to manage key usage and access.
B) Enable S3 Object Lock in compliance mode, enforce customer-managed KMS encryption, implement bucket policies for least-privilege access, and consolidate CloudTrail logs into a centralized audit account.
C) Use SSE-C encryption and manually review deletions and access logs weekly.
D) Encrypt objects post-upload with client-side tools and rely on developers for access control.

Answer:
B

Explanation:

Option A relies on SSE-S3 encryption and manual administrative enforcement. While SSE-S3 provides encryption at rest, it does not enforce control over which keys are used or prevent unauthorized deletions. Manual enforcement of key usage and access control is error-prone and not scalable for a multinational organization with multiple accounts, regions, and teams. SSE-S3 cannot enforce immutability or retention, leaving sensitive intellectual property vulnerable to accidental or malicious deletion. Centralized auditing is limited if administrators are responsible for reviewing individual bucket activity manually.

Option B is the comprehensive enterprise solution. S3 Object Lock in compliance mode enforces immutability, ensuring that objects cannot be deleted or altered during the retention period, which is critical for regulatory and internal data protection requirements. Customer-managed KMS keys provide granular control over encryption, including rotation, audit logging, and access restrictions. Bucket policies enforce least-privilege access, mitigating insider threats and ensuring only authorized users can perform operations on sensitive objects. Centralized CloudTrail logging across all accounts consolidates activity records, enabling visibility into deletions, modifications, and access events. Combined with EventBridge or other monitoring services, this solution allows real-time alerts for any policy violations. Option B addresses preventive, detective, and corrective security controls in an integrated manner, making it fully compliant with enterprise-grade security and operational requirements.

Option C, SSE-C encryption with manual review, requires the organization to manage keys locally, which is operationally intensive, prone to errors, and not scalable. Manual log review does not provide real-time detection or automated remediation. Option D, client-side encryption post-upload with manual access control, exposes risks through inconsistent enforcement, reliance on human processes, and lack of centralized audit capability.

Question162:

A healthcare company is deploying Amazon RDS to store patient records. Security policies require encryption at rest and in transit, identity-based access, automated credential rotation, and centralized auditing of all database operations. Which solution satisfies these requirements?

A) Enable RDS encryption with AWS-managed keys, grant broad developer access, and enforce SSL/TLS.
B) Use customer-managed KMS keys for RDS encryption, enforce SSL/TLS, implement IAM database authentication, automate credential rotation using AWS Secrets Manager, and configure CloudTrail logging.
C) Store database credentials in environment variables and rely on default encryption.
D) Enable point-in-time recovery and manually review logs weekly.

Answer:
B

Explanation:

Option A provides encryption at rest using AWS-managed keys and SSL/TLS for transit security, but granting broad access to developers violates least-privilege principles. AWS-managed keys provide limited control over rotation and auditing. The lack of automated credential management and centralized logging leaves operational gaps and potential compliance violations. This approach is inadequate for sensitive healthcare data subject to regulatory frameworks such as HIPAA.

Option B is the complete enterprise-grade solution. Customer-managed KMS keys allow the organization to maintain control over encryption at rest, enabling key rotation, detailed usage tracking, and audit logging. SSL/TLS ensures encryption in transit, protecting data from interception and tampering. IAM database authentication enforces identity-based access control, adhering to the principle of least privilege and minimizing insider risk. AWS Secrets Manager automates credential rotation, reducing exposure of sensitive credentials and minimizing operational overhead. CloudTrail logs provide centralized auditing of all database operations and configuration changes, supporting regulatory compliance, operational monitoring, and forensic investigations. This solution integrates preventive, detective, and corrective controls, ensuring both security and operational efficiency.

Option C exposes credentials in environment variables, lacks automated rotation, and fails to provide centralized auditing or enforcement of encryption standards. Option D relies on reactive recovery and manual review, leaving gaps in preventive and detective security measures, and is impractical for operationally complex environments.

Option B meets all security, operational, and compliance requirements, providing a secure, auditable, and automated framework for handling sensitive patient data in RDS.

Option B goes beyond basic encryption and access control by providing a holistic, enterprise-grade security posture for RDS instances handling sensitive healthcare data. Using customer-managed KMS keys gives organizations full control over encryption at rest, including key lifecycle management, rotation policies, and detailed access auditing. This ensures that encryption aligns with internal security policies and regulatory requirements. SSL/TLS enforces encryption in transit, safeguarding data integrity and confidentiality as it moves between applications and the database. Implementing IAM database authentication replaces static credentials with identity-based access, significantly reducing the risk of credential compromise and supporting the principle of least privilege, which is critical in environments where multiple developers and services interact with sensitive patient data.

Automating credential rotation through AWS Secrets Manager reduces human error, prevents stale or compromised credentials from remaining active, and eliminates the operational burden of manual rotation. CloudTrail logging centralizes visibility into all database interactions and configuration changes, enabling continuous monitoring, anomaly detection, and rapid incident response. This integrated approach ensures that preventive, detective, and corrective controls work together to maintain robust security and operational efficiency. By combining encryption, identity-based authentication, automated secret management, and centralized auditing, Option B provides a comprehensive framework that satisfies both compliance mandates and best-practice security requirements, making it the optimal choice for managing sensitive RDS workloads in healthcare environments.

Question163:

A financial institution must secure sensitive transaction logs stored in Amazon S3. Requirements include preventing accidental or malicious deletions, enforcing immutability, mitigating insider threats, and centralized auditing. Which solution is best?
A) Enable S3 versioning and rely on developers to prevent deletions.
B) Enable S3 Object Lock in compliance mode, enforce strict bucket policies, and enable CloudTrail logging.
C) Maintain manual backups and track deletions manually.
D) Encrypt objects with SSE-S3 and allow developers to manage access manually.

Answer:
B

Explanation:

Option A, enabling versioning and relying on developers, provides recovery options but does not proactively prevent deletions or modifications. Relying on manual enforcement introduces operational risk and is not scalable for enterprise environments. Versioning does not enforce immutability, nor does it sufficiently mitigate insider threats.

Option B provides a fully integrated solution. S3 Object Lock in compliance mode ensures immutability, preventing deletions or modifications of transaction logs during the retention period. Strict bucket policies restrict access to authorized personnel only, mitigating insider threats. CloudTrail logging centralizes auditing, offering visibility into object operations, supporting regulatory compliance, operational oversight, and forensic investigations. Event-driven monitoring through EventBridge or Lambda can trigger real-time notifications and remediation for any policy violations. This solution combines preventive, detective, and corrective controls into a scalable, enterprise-ready system for protecting highly sensitive financial transaction logs.

Option C relies on manual backups and deletion tracking, which is reactive, labor-intensive, and prone to error, making it impractical for high-volume enterprise data. Option D encrypts objects but does not enforce immutability or automated access control, leaving compliance and insider threat gaps.

Option B satisfies all organizational, operational, and compliance requirements, offering secure, auditable, and scalable protection for sensitive financial transaction logs.

Question164:

A healthcare provider uses AWS Lambda to process sensitive patient data. Security policies require that Lambda invocations occur only through approved API Gateway endpoints and that all invocations are auditable. Which solution is appropriate?

A) Allow all IAM users to invoke Lambda and rely on logging.
B) Attach resource-based policies restricting invocation to approved API Gateway principals and enable CloudTrail logging.
C) Store invocation secrets in environment variables for developers.
D) Protect Lambda functions with API keys and rely on developers not to share them.

Answer:
B

Explanation:

Option A allows unrestricted Lambda invocation and relies solely on logging, which does not prevent unauthorized access and fails regulatory requirements for sensitive healthcare data. Option C stores secrets in environment variables, which is insecure and does not enforce preventive access controls. Option D relies on API keys and developer discipline, which is operationally unreliable, not scalable, and fails to provide auditable controls.

Option B is the enterprise-grade solution. Resource-based policies enforce preventive access control by restricting Lambda invocations to approved API Gateway principals. CloudTrail logging provides centralized, auditable records of all Lambda invocations, supporting regulatory compliance, monitoring, and forensic analysis. The combination of preventive and detective controls ensures that Lambda functions process sensitive patient data only through authorized channels. This solution is scalable, operationally efficient, and fully compliant with organizational and regulatory requirements for healthcare workloads.

Question165:

Answer:
B

Explanation:

Option A exposes credentials in environment variables, lacks automated rotation, and provides no centralized auditing. Option C relies on hard-coded credentials, which are insecure, difficult to rotate, and operationally inefficient. Option D uses long-lived IAM credentials, increasing the risk of compromise and administrative overhead.

Option B delivers a secure, automated, and auditable solution. Parameter Store SecureString parameters encrypt API keys and restrict access to authorized IAM roles. Assigning IAM roles to EC2 instances enforces least-privilege access, ensuring only authorized instances retrieve credentials. Automated rotation reduces exposure risk and operational burden. CloudTrail logging provides centralized auditing and monitoring of all access events, supporting forensic analysis and compliance verification. Preventive, detective, and corrective controls are integrated, ensuring secure, operationally efficient, and compliant access to internal APIs for EC2 instances.

Security Risks of Environment Variables

Option A, storing API keys in environment variables and rotating them manually, introduces several critical security and operational risks. Environment variables are accessible to all processes running on the same EC2 instance, which significantly increases the potential attack surface. Any process or user with sufficient privileges on the instance can read these variables, making them vulnerable to malicious insiders or compromised processes. Furthermore, environment variables can unintentionally be exposed through logging, monitoring, or debugging outputs. For instance, if an application encounters an error and logs environment information for troubleshooting purposes, API keys may be captured in plaintext in log files or monitoring systems. This exposure can occur without the knowledge of administrators and may persist for extended periods if logs are not properly managed or secured.

Manual rotation adds another layer of risk. Human-driven processes are inherently prone to errors, such as forgetting to rotate credentials on schedule, failing to update all relevant EC2 instances consistently, or misconfiguring permissions after rotation. In environments with large numbers of instances, coordinating manual rotations becomes a complex task and increases operational overhead. Delays or inconsistencies in rotation leave credentials exposed for longer periods, extending the risk of compromise. Additionally, this approach lacks centralized tracking and auditability, making it challenging for organizations to demonstrate that rotations were performed systematically and in accordance with enterprise security policies or regulatory compliance standards. Without verifiable evidence of rotation and controlled access, organizations may face compliance issues with regulatory frameworks such as PCI DSS, HIPAA, and ISO 27001.

Operational and Security Challenges of Hard-Coded Credentials

Option C, embedding credentials directly in application code, introduces substantial risks to security, auditability, and operational efficiency. Hard-coded credentials are static and long-lived, meaning they remain valid until the application code is modified, tested, and redeployed. This creates an extended exposure window, as compromised credentials remain active until manually updated. If the source code containing credentials is stored in version control systems or shared among multiple developers, there is a risk of inadvertent exposure. Credentials may be accessed by unauthorized users, particularly in organizations with large development teams or cross-functional collaboration.

From an operational perspective, rotating hard-coded credentials is a cumbersome and error-prone process. Each update requires changes to the application code, testing to ensure compatibility, and redeployment across all instances that rely on the credential. In large-scale environments, this approach introduces significant administrative overhead, increases the risk of downtime, and may result in inconsistencies where some instances still use outdated credentials while others have the updated version. Hard-coded credentials also bypass centralized access control mechanisms, preventing enforcement of the principle of least privilege. Applications have permanent access to credentials regardless of whether they require it for a particular workflow, further increasing the risk of misuse or compromise.

Auditing and compliance monitoring are also severely limited with hard-coded credentials. Security teams have no centralized record of when or how credentials are accessed, making it difficult to detect unauthorized access or respond to potential breaches. In regulated industries, this lack of visibility creates compliance challenges, as organizations are unable to demonstrate controlled access, proper rotation, or accountability for credential usage. This makes hard-coded credentials unsuitable for enterprise-scale deployments or environments that require adherence to strict security and compliance standards.

Limitations of Long-Lived IAM User Credentials

Option D, using long-lived IAM user credentials for each EC2 instance, introduces both security and operational complications. IAM user credentials are intended primarily for human access rather than for automated workloads. Storing long-lived credentials on EC2 instances increases the risk of exposure because credentials remain valid until manually rotated or revoked. In the event of compromise, unauthorized actors can leverage these credentials over an extended period, resulting in significant security incidents.

Operationally, managing multiple long-lived IAM credentials across a large number of EC2 instances is highly complex. Administrators must track, rotate, and audit each credential individually, which increases the likelihood of misconfiguration or oversight. Auditing actions performed with IAM user credentials is also difficult, as all activity is attributed to the user identity rather than the specific instance or workload. This makes it challenging to identify the source of unauthorized activity and hampers forensic investigation. Long-lived credentials violate the principle of least privilege, as they provide continuous access regardless of whether the workload still requires it, increasing both security and compliance risks. Overall, using long-lived IAM credentials is operationally inefficient, insecure, and unsuitable for enterprise-scale environments that require dynamic, scalable, and auditable credential management.

Benefits of Parameter Store SecureString Parameters

Option B addresses these risks by providing a secure, automated, and auditable solution. AWS Systems Manager Parameter Store supports SecureString parameters, which encrypt sensitive API keys using AWS Key Management Service (KMS). Encryption ensures that credentials are protected both at rest and in transit, reducing the likelihood of unauthorized access. SecureString parameters provide centralized management of secrets, allowing administrators to create, update, and revoke credentials from a single location. This eliminates the need for distributing static credentials across multiple instances, reducing the risk of inconsistencies and exposure. Fine-grained IAM access policies allow administrators to define precisely which roles or users can retrieve specific secrets, ensuring least-privilege access and minimizing the risk of credential misuse.

Centralized secret management also enhances operational efficiency. Administrators can modify or revoke credentials without redeploying applications or manually updating each EC2 instance. This reduces administrative overhead, streamlines operations, and ensures that all instances consistently retrieve the correct credentials. By centralizing control, organizations improve visibility over credential usage, making it easier to monitor access patterns, detect anomalies, and maintain compliance with enterprise security policies.

IAM Role-Based Access Control

Assigning IAM roles to EC2 instances is a critical security measure within Option B. IAM roles provide temporary, dynamically generated credentials that allow EC2 instances to retrieve secrets from Parameter Store securely. This ensures that credentials are not statically stored in the environment or hard-coded into applications, reducing the risk of exposure. IAM roles can be managed centrally, updated, or revoked without redeploying applications, enabling administrators to enforce strong access policies dynamically.

Role-based access ensures that each instance or workload receives only the credentials necessary for its specific operations, enforcing the principle of least privilege. This minimizes the impact of potential compromise, as unauthorized processes cannot access credentials outside their assigned scope. Temporary credentials also expire automatically, further reducing exposure risk and ensuring that access remains tightly controlled. In dynamic cloud environments with frequent instance provisioning and decommissioning, IAM roles provide scalable and flexible access control that adapts to changing operational needs without sacrificing security.

Automated Rotation Reduces Exposure Risk

Automated rotation of SecureString parameters is a major advantage of Option B. Secrets are rotated at predefined intervals without human intervention, reducing the likelihood that compromised credentials remain valid. Applications retrieve updated credentials dynamically at runtime, maintaining continuous access without operational disruption. Automated rotation minimizes administrative burden, eliminates human error associated with manual rotation, and ensures consistent security practices across all EC2 instances. Automated rotation also supports compliance requirements by providing evidence that credentials are systematically rotated and managed according to organizational policies and regulatory standards.

Centralized Auditing and Monitoring with CloudTrail

Integration with AWS CloudTrail provides centralized auditing and monitoring for all interactions with Parameter Store. Every retrieval, modification, or rotation event is logged with details such as the requesting principal, timestamp, and resource accessed. Centralized logging allows security teams to monitor access patterns, detect unauthorized attempts, and respond to potential security incidents proactively. CloudTrail logs also provide verifiable evidence for regulatory compliance, ensuring that credential access and management practices can be reviewed and audited. Organizations can leverage these logs for forensic investigations, policy enforcement, and internal security reviews, maintaining accountability and transparency.

Integration of Preventive, Detective, and Corrective Controls

Option B integrates preventive, detective, and corrective controls into a single, cohesive solution. Preventive controls include encryption with KMS and role-based access policies, which block unauthorized access. Detective controls are implemented through CloudTrail logging, enabling continuous monitoring and anomaly detection. Corrective controls are facilitated by automated rotation, allowing compromised secrets to be replaced quickly. This layered approach ensures that credentials are protected throughout their lifecycle and that organizations can respond effectively to security events, mitigating risk and enhancing operational resilience.

Amazon AWS Certified Security — Speciality SCS-C02 Exam Dumps and Practice Test Questions Set 11 Q151-165

Amazon AWS Certified Security — Speciality SCS-C02 Exam Dumps and Practice Test Questions Set 11 Q151-165

Related posts: