Amazon Web Services Updated SCS-C01 Exam Questions and Answers by samir

Use custom route tables to prevent malicious traffic from routing to the instances.

Update security groups to deny traffic from the originating source IP addresses.

Use network ACLs.

Install intrusion prevention software (IPS) on each instance.

Use a Network Load Balancer (NLB) to pass through traffic on port 443 from the internet to port 443 on the instances.

Purchase an external certificate, and upload it to the IAM Certificate Manager (for use with the ELB) and to the instances. Have the ELB decrypt traffic, and route and re-encrypt with the same certificate.

Generate an internal self-signed certificate and apply it to the instances. Use IAM Certificate Manager to generate a new external certificate for the ELB. Have the ELB decrypt traffic, and route and re-encrypt with the internal certificate.

Upload a new external certificate to the load balancer. Have the ELB decrypt the traffic and forward it on port 80 to the instances.

Use the IAM account root user access keys instead of the IAM Management Console

Enable multi-factor authentication for the IAM IAM users with the AdministratorAccess managed policy attached to them

Enable multi-factor authentication for the IAM account root user

Use IAM KMS to encrypt all IAM account root user and IAM IAM access keys and set automatic rotation to 30 days

Do not create access keys for the IAM account root user; instead, create IAM IAM users

The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.

The Lambda function was executed by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs.

The execution role for the Lambda function did not grant permissions to write to the Amazon S3 bucket where CloudWatch Logs stores the logs.

The version of the Lambda function that was executed was not current.