SCS-C03 · Question #12
A company is planning to migrate its applications to AWS in a single AWS Region. The company's applications will use a combination of Amazon EC2 instances, Elastic Load Balancing (ELB) load…
The correct answer is B. Enable Amazon GuardDuty in all AWS accounts. D. Configure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from F. Use AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket. Explanation B, D, and F address each of the three requirements with minimal effort using native AWS managed services. GuardDuty (B) provides anomalous network traffic monitoring across endpoints by analyzing VPC Flow Logs, DNS logs, and CloudTrail events with a single-click…
Question
A company is planning to migrate its applications to AWS in a single AWS Region. The company's applications will use a combination of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, and Amazon S3 buckets. The company wants to complete the migration as quickly as possible. All the applications must meet the following requirements:
- Data must be encrypted at rest.
- Data must be encrypted in transit.
- Endpoints must be monitored for anomalous network traffic.
Which combination of steps should a security engineer take to meet these requirements with the LEAST effort? (Select THREE.)
Options
- AInstall the Amazon Inspector agent on EC2 instances by using AWS Systems Manager
- BEnable Amazon GuardDuty in all AWS accounts.
- CCreate VPC endpoints for Amazon EC2 and Amazon S3. Update VPC route tables to use only
- DConfigure AWS Certificate Manager (ACM). Configure the load balancers to use certificates from
- EUse AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket
- FUse AWS Key Management Service (AWS KMS) for key management. Create an S3 bucket
How the community answered
(28 responses)- A4% (1)
- B79% (22)
- C11% (3)
- E7% (2)
Explanation
Explanation
B, D, and F address each of the three requirements with minimal effort using native AWS managed services. GuardDuty (B) provides anomalous network traffic monitoring across endpoints by analyzing VPC Flow Logs, DNS logs, and CloudTrail events with a single-click enablement - no agent installation required. ACM with load balancer certificates (D) enforces encryption in transit by terminating TLS/SSL at the load balancer using managed certificates that auto-renew. KMS with S3 bucket policies (F) enforces encryption at rest using server-side encryption (SSE-KMS), satisfying the data-at-rest requirement across S3 storage.
Why the Distractors Are Wrong:
- A (Amazon Inspector): Inspector performs vulnerability assessments, not anomalous network traffic monitoring, and requires agent installation - higher effort with no direct fit.
- C (VPC Endpoints): While useful for private connectivity, VPC endpoints don't directly satisfy encryption at rest or in transit requirements, and involve additional routing complexity.
- E: Appears nearly identical to F but likely lacks the S3 bucket policy enforcement that requires encryption, making it incomplete for meeting the requirement.
Memory Tip
Think "Guard, Cert, Key" - GuardDuty monitors traffic, Certificates encrypt transit, KMS encrypts rest. Match each requirement to one managed AWS service for the least effort approach.
Topics
Community Discussion
No community discussion yet for this question.