Welcome to ExamTopics
ExamTopics Logo
- Expert Verified, Online, Free.
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Security - Specialty SCS-C02 All Questions

View all questions & answers for the AWS Certified Security - Specialty SCS-C02 exam
Go to Exam

Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 4 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02
Question #: 4
Topic #: 1
[All AWS Certified Security - Specialty SCS-C02 Questions]

A company has an organization in AWS Organizations. The company wants to use AWS CloudFormation StackSets in the organization to deploy various AWS design patterns into environments. These patterns consist of Amazon EC2 instances, Elastic Load Balancing (ELB) load balancers, Amazon RDS databases, and Amazon Elastic Kubernetes Service (Amazon EKS) clusters or Amazon Elastic Container Service (Amazon ECS) clusters.
Currently, the company’s developers can create their own CloudFormation stacks to increase the overall speed of delivery. A centralized CI/CD pipeline in a shared services AWS account deploys each CloudFormation stack.
The company's security team has already provided requirements for each service in accordance with internal standards. If there are any resources that do not comply with the internal standards, the security team must receive notification to take appropriate action. The security team must implement a notification solution that gives developers the ability to maintain the same overall delivery speed that they currently have.
Which solution will meet these requirements in the MOST operationally efficient way?

  • A. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team's email addresses to the SNS topic. Create a custom AWS Lambda function that will run the aws cloudformation validate-template AWS CLI command on all CloudFormation templates before the build stage in the CI/CD pipeline. Configure the CI/CD pipeline to publish a notification to the SNS topic if any issues are found.
  • B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the security team's email addresses to the SNS topic. Create custom rules in CloudFormation Guard for each resource configuration. In the CI/CD pipeline, before the build stage, configure a Docker image to run the cfn-guard command on the CloudFormation template. Configure the CI/CD pipeline to publish a notification to the SNS topic if any issues are found.
  • C. Create an Amazon Simple Notification Service (Amazon SNS) topic and an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the security team's email addresses to the SNS topic. Create an Amazon S3 bucket in the shared services AWS account. Include an event notification to publish to the SQS queue when new objects are added to the S3 bucket. Require the developers to put their CloudFormation templates in the S3 bucket. Launch EC2 instances that automatically scale based on the SQS queue depth. Configure the EC2 instances to use CloudFormation Guard to scan the templates and deploy the templates if there are no issues. Configure the CI/CD pipeline to publish a notification to the SNS topic if any issues are found.
  • D. Create a centralized CloudFormation stack set that includes a standard set of resources that the developers can deploy in each AWS account. Configure each CloudFormation template to meet the security requirements. For any new resources or configurations, update the CloudFormation template and send the template to the security team for review. When the review is completed, add the new CloudFormation stack to the repository for the developers to use.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by 100fold at Oct. 19, 2023, 3:29 a.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Submit Cancel
ET1857
2 weeks, 2 days ago
Selected Answer: A
because of line "configure a Docker image to run the cfn-guard command on the CloudFormation template." Option B should not be considered because its not a optimal solution
upvoted 3 times
...
hro
6 months, 2 weeks ago
The answer is A. What does docker have to do with the question? Furthermore, you can validate a template with validate-template - no need for cloudformation guard.
upvoted 1 times
...
Raphaello
7 months, 4 weeks ago
Selected Answer: B
You may use a lambda function to validate the syntax and semantics of CloudFormation templates. But when it comes to validate to a compliance policy, CloudFormation Guard makes more sense. Option B is correct.
upvoted 2 times
...
Raphaello
9 months, 4 weeks ago
Command "aws cloudformation validate-template" checks only the syntax of cfn template. I'd go with answer B, CloudFormation Guard, as it evaluates and validates cfn templates.
upvoted 1 times
...
Aamee
10 months, 1 week ago
Selected Answer: B
Def. going with B as it doesn't ask to improve the delivery speed. Had that been the case then probably would have gone with option A IMO.
upvoted 1 times
...
Christina666
10 months, 3 weeks ago
Selected Answer: B
BBB The ask is to send notification and not affecting current delivery speed. So only need to add a validation step to send SNS
upvoted 1 times
...
Daniel76
10 months, 4 weeks ago
Selected Answer: A
Option A likely is utilizing cfn-guard as well but by Lambda/cli command, instead of creating custom rules for each resource config.More operationally efficient than B.
upvoted 1 times
...
lalee2
11 months, 1 week ago
Selected Answer: B
CloudFormation Guard and SNS
upvoted 2 times
...
pupsik
11 months, 2 weeks ago
Selected Answer: B
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html#:~:text=Validate%20templates%20for,non%2Dcompliant%20resources.
upvoted 3 times
...
leoaquinods
11 months, 2 weeks ago
Selected Answer: A
most operationally efficient
upvoted 1 times
...
KR693
11 months, 2 weeks ago
Option B. The aws cloudformation validate-template command is designed to check only the syntax of your template. Using Guard, you can write policy rules to validate any JSON- or YAML-formatted structured data against, including but not limited to AWS CloudFormation templates. Guard supports the entire spectrum of end-to-end evaluation of policy checks
upvoted 3 times
...
100fold
11 months, 2 weeks ago
Answer A. Most operationally efficient
upvoted 1 times
100fold
11 months ago
Answer B. My original selection
upvoted 1 times
...
...
Lunga778
11 months, 3 weeks ago
answerer is A
upvoted 2 times
...
100fold
11 months, 3 weeks ago
Selected Answer: B
Answer B. You can use cfn-guard automatically as part of a CI/CD pipeline to stop deployment of non-compliant resources. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html
upvoted 3 times
100fold
11 months, 2 weeks ago
Changed to answer A
upvoted 1 times
100fold
11 months ago
Original selection B
upvoted 1 times
...
...
...

Get IT Certification

Unlock free, top-quality video courses on ExamTopics with a simple registration. Elevate your learning journey with our expertly curated content. Register now to access a diverse range of educational resources designed for your success. Start learning today with ExamTopics!

Start Learning for free
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel