Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Amazon Exam SCS-C02 Topic 8 Question 11 Discussion

Actual exam question for Amazon's SCS-C02 exam
Question #: 11
Topic #: 8
[All SCS-C02 Questions]

A company uses infrastructure as code (IaC) to create AWS infrastructure. The company writes the code as AWS CloudFormation templates to deploy the infrastructure. The company has an existing CI/CD pipeline that the company can use to deploy these templates.

After a recent security audit, the company decides to adopt a policy-as-code approach to improve the company's security posture on AWS. The company must prevent the deployment of any infrastructure that would violate a security policy, such as an unencrypted Amazon Elastic Block Store (Amazon EBS) volume.

Which solution will meet these requirements?

Show Suggested Answer Hide Answer
Suggested Answer: C

The correct answer is C. Create rule sets in AWS CloudFormation Guard. Run validation checks for CloudFormation templates as a phase of the CI/CD process.

This answer is correct because AWS CloudFormation Guard is a tool that helps you implement policy-as-code for your CloudFormation templates. You can use Guard to write rules that define your security policies, such as requiring encryption for EBS volumes, and then validate your templates against those rules before deploying them. You can integrate Guard into your CI/CD pipeline as a step that runs the validation checks and prevents the deployment of any non-compliant templates12.

The other options are incorrect because:

A) Turning on AWS Trusted Advisor and configuring security notifications as webhooks in the preferences section of the CI/CD pipeline is not a solution, because AWS Trusted Advisor is not a policy-as-code tool, but a service that provides recommendations to help you follow AWS best practices. Trusted Advisor does not allow you to define your own security policies or validate your CloudFormation templates against them3.

B) Turning on AWS Config and using the prebuilt or customized rules is not a solution, because AWS Config is not a policy-as-code tool, but a service that monitors and records the configuration changes of your AWS resources. AWS Config does not allow you to validate your CloudFormation templates before deploying them, but only evaluates the compliance of your resources after they are created4.

D) Creating rule sets as SCPs and integrating them as a part of validation control in a phase of the CI/CD process is not a solution, because SCPs are not policy-as-code tools, but policies that you can use to manage permissions in your AWS Organizations. SCPs do not allow you to validate your CloudFormation templates, but only restrict the actions that users and roles can perform in your accounts5.


1: What is AWS CloudFormation Guard? 2: Introducing AWS CloudFormation Guard 2.0 3: AWS Trusted Advisor 4: What Is AWS Config? 5: Service control policies - AWS Organizations

by Ma at Jan 26, 2024, 01:46 PM

Limited Time Offer

25%

Off

Get Premium SCS-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel
Bulah
9 days ago
Hmm, I'm not sure about that. Option B relies on AWS Config to detect the issues, but that means we're still allowing the non-compliant resources to be deployed, even if we get notified about it. I think a proactive approach like CloudFormation Guard is better.
upvoted 0 times
...
Julian
10 days ago
What about option B with AWS Config? That seems like a good solution too. We can leverage the prebuilt rules or create our own, and then have the pipeline subscribe to the SNS topic to receive notifications. That way, we can still catch non-compliant resources, even if they slip through the initial validation.
upvoted 0 times
...
Luisa
11 days ago
I agree, option C sounds like the way to go. Creating custom rule sets in CloudFormation Guard allows us to define our security policies programmatically and integrate them directly into our CI/CD pipeline. That way, we can catch any issues early on before they make it to production.
upvoted 0 times
...
Kimbery
12 days ago
Hmm, this seems like a tricky question. We need a solution that can enforce our security policies and prevent the deployment of any non-compliant infrastructure. I'm leaning towards option C - using AWS CloudFormation Guard to validate our templates before deployment.
upvoted 0 times
...

Save Cancel