Amazon AWS Certified Security - Specialty SCS-C02 Exam Practice Questions (P. 2)

GPT-4o - Answer

AWS Backup enables the setup of automatic backup plans per the specified schedule, fitting the company’s need to back up on the 15th and 25th days of each month and retain these for three months. Additionally, using a cron schedule for backup frequency eases the adherence to very specific periodic backup requirements, especially those on fixed days each month. AWS DataSync isn't appropriate here as its primary use is for data transfer rather than backup tasks. Thus, utilizing AWS Backup in combination with cron scheduled expressions provides a comprehensive solution that directly addresses the company's requirements.

GPT-4o - Answer

In managing multi-account authentication and authorization without introducing extraneous user-managed architectural elements, leveraging AWS IAM Identity Center (formerly AWS Single Sign-On) proves most efficient. It inherently simplifies user and group creation, managing permissions, and benefits from AWS-native integration. This not only reduces administrative overhead by eliminating the need for duplicated IAM user configurations across accounts but also aligns perfectly with the use of AWS native features and streamlined operations without on-premise dependencies. Thus, the initial setup through AWS IAM Identity Center using its default directory is indeed the correct approach to satisfy these requirements.

GPT-4o - Answer

The selected answer, which involves using Amazon Kinesis data stream, effectively leverages AWS services for real-time processing of GuardDuty events to automate threat response actions. By having Kinesis Data Analytics process events and trigger responses such as notifications via SNS and modifying Network ACLs to block traffic, the solution is not only responsive but also minimizes potential damages by isolating the suspicious instance swiftly. This approach is more aligned with Amazon best practices for handling real-time security events, ensuring a robust defense mechanism is in place against threats like RDP brute force attacks on EC2 instances.

GPT-4o - Answer

Option B is the most efficient method in this scenario for investigating the security incident reported by GuardDuty. Utilizing read-only credentials ensures that the security checkup does not interfere with application function or data integrity. Amazon Detective's integration with GuardDuty facilitates rapid analysis by providing contextual insight into the suspicious API activities, enhancing the speed and accuracy of the investigation process. This approach is not only swift but also maintains a high level of security compliance by avoiding any modifications to existing permissions or settings.

GPT-4o - Answer

The correct approach here involves setting the appropriate access permissions at the S3 bucket policy level, as multiple users suggested. For cross-account accessibility, the S3 bucket policy in Account B should be configured to identify and allow actions from the principal (user/account ID) in Account A. This setup directly aligns permissions with the bucket, facilitating seamless access without modifying individual object ACLs or requiring complex user policy configurations. It's a common practice that ensures broader and more manageable access controls for resources shared across different AWS accounts.