Amazon Exam SCS-C02 Topic 8 Question 25 Discussion

Actual exam question for Amazon's SCS-C02 exam

Question #: 25
Topic #: 8

A company uses AWS Organizations to manage a multi-accountAWS environment in a single AWS Region. The organization's management account is named management-01. The company has turned on AWS Config in all accounts in the organization. The company has designated an account named security-01 as the delegated administra-tor for AWS Config.

All accounts report the compliance status of each account's rules to the AWS Config delegated administrator account by using an AWS Config aggregator. Each account administrator can configure and manage the account's own AWS Config rules to handle each account's unique compliance requirements.

A security engineer needs to implement a solution to automatically deploy a set of 10 AWS Config rules to all existing and future AWS accounts in the organiza-tion. The solution must turn on AWS Config automatically during account crea-tion.

Which combination of steps will meet these requirements? (Select TWO.)

ACreate an AWS CloudFormation template that contains the 1 0 required AVVS Config rules. Deploy the template by using CloudFormation StackSets in the security-01 account.

BCreate a conformance pack that contains the 10 required AWS Config rules. Deploy the conformance pack from the security-01 account.

CCreate a conformance pack that contains the 10 required AWS Config rules. Deploy the conformance pack from the management-01 account.

DCreate an AWS CloudFormation template that will activate AWS Config. De-ploy the template by using CloudFormation StackSets in the security-01 ac-count.

ECreate an AWS CloudFormation template that will activate AWS Config. De-ploy the template by using CloudFormation StackSets in the management-01 account.

Show Suggested Answer

Suggested Answer: D

To ensure minimal latency and regional availability of secrets, encrypting secrets in us-east-1 with a customer-managed KMS key and then replicating them to us-west-1 for encryption with the same key is the optimal approach. This method leverages customer-managed KMS keys for enhanced control and ensures that secrets are available in both regions, adhering to disaster recovery principles and minimizing latency by using regional endpoints.

by Daron at Aug 06, 2024, 06:12 PM

Limited Time Offer

25%

Off

Get Premium SCS-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Carol

1 months ago

Haha, I'm imagining the security engineer trying to find the perfect 10 Config rules to deploy. Like, 'Hmm, should we go with the classic 'S3 Bucket Versioning' and 'RDS Encryption' rules, or do we need to get a little wild and crazy?'

upvoted 0 times

Erick

15 hours ago

B: Yeah, and we can also create a conformance pack with the rules and deploy it from the security-01 account.

upvoted 0 times

...

Fernanda

22 days ago

A: Let's go with option A and create a CloudFormation template with the 10 required rules in the security-01 account.

upvoted 0 times

...

Cecil

2 months ago

I'm just wondering, does the CloudFormation template in D or E have to include the 10 required Config rules, or is that handled separately? I want to make sure I have the right understanding.

upvoted 0 times

Melita

22 days ago

B) That's correct. You would create a conformance pack that contains the 10 required AWS Config rules and deploy it from the security-01 account.

upvoted 0 times

...

Gerald

27 days ago

D) No, the CloudFormation template in D or E does not have to include the 10 required Config rules. The rules are handled separately.

upvoted 0 times

...

Delsie

2 months ago

I agree with Jesusita. B and D are the way to go. Deploying the conformance pack from the security-01 account and automating the Config activation makes the most sense.

upvoted 0 times

...

Scarlet

2 months ago

I'm not sure, but maybe we should also consider creating an AWS CloudFormation template in the management-01 account.

upvoted 0 times

...

Salena

2 months ago

I agree with Deandrea. That seems like the best option to automatically deploy the AWS Config rules.

upvoted 0 times

...

Sherita

2 months ago

Hmm, I'm not sure about D. Wouldn't it be better to use the management-01 account to deploy the CloudFormation template and activate AWS Config? That way, it's done from the central management account.

upvoted 0 times

Cecil

8 days ago

B: Definitely. Let's go with option E for deploying the CloudFormation template and activating AWS Config.

upvoted 0 times

...

Ronny

12 days ago

A: So, we both think option E is the way to go then?

upvoted 0 times

...

Lucy

22 days ago

B: Yeah, I agree. Using the management-01 account for deployment seems like a more centralized approach.

upvoted 0 times

...

Elin

30 days ago

A: I think option E makes more sense. It's better to activate AWS Config from the central management account.

upvoted 0 times

...

Jesusita

2 months ago

I think B and D are the right steps to meet the requirements. Deploying the conformance pack from the security-01 account and using CloudFormation StackSets to activate AWS Config seem like the most efficient approach.

upvoted 0 times

...

Deandrea

2 months ago

I think we should create a conformance pack from the security-01 account.

upvoted 0 times

...