Exam Bundle

Local hard-coded passwords: Place secrets in an application or machine configuration rather than a managed secret store. This does not address the need for A company wants enterprise SSO and federation for cloud access. The appropriate Federated authentication applies because Federation lets AWS rely on a trusted external identity provider for authentication.

Individual root accounts are privileged account owner identities, not a least-privilege mechanism for routine work. This does not address the need for A company wants enterprise SSO and federation for cloud access. The appropriate Federated authentication applies because Federation lets AWS rely on a trusted external identity provider for authentication.

Shared permanent access key: Allows multiple users or workloads to share long-lived credentials without clear attribution. This does not address the need for A company wants enterprise SSO and federation for cloud access. The appropriate Federated authentication applies because Federation lets AWS rely on a trusted external identity provider for authentication.

AWS Shield provides DDoS protection against supported traffic attacks. That does not meet the requirement: A public web API needs to block malicious HTTP requests based on web request rules.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. That does not meet the requirement: A public web API needs to block malicious HTTP requests based on web request rules.

Security group: Filters supported resource network traffic using stateful rules. That does not meet the requirement: A public web API needs to block malicious HTTP requests based on web request rules.

AWS Shield provides DDoS protection against supported traffic attacks. This does not address the need for A public web API needs to block malicious HTTP requests based on web request rules. The appropriate AWS WAF applies because AWS WAF inspects and filters HTTP(S) requests with web access-control rules.

Security group: Filters supported resource network traffic using stateful rules. This does not address the need for A public web API needs to block malicious HTTP requests based on web request rules. The appropriate AWS WAF applies because AWS WAF inspects and filters HTTP(S) requests with web access-control rules.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. This does not address the need for A public web API needs to block malicious HTTP requests based on web request rules. The appropriate AWS WAF applies because AWS WAF inspects and filters HTTP(S) requests with web access-control rules.

Security group: Filters supported resource network traffic using stateful rules. That does not meet the requirement: Consider this AWS requirement: A website owner wants to reduce common web exploits such as SQL injection patterns at an application endpoint.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. That does not meet the requirement: Consider this AWS requirement: A website owner wants to reduce common web exploits such as SQL injection patterns at an application endpoint.

AWS Shield provides DDoS protection against supported traffic attacks. That does not meet the requirement: Consider this AWS requirement: A website owner wants to reduce common web exploits such as SQL injection patterns at an application endpoint.

Amazon GuardDuty: Detects suspicious activity through supported telemetry. This does not address the need for A website owner wants to reduce common web exploits such as SQL injection patterns at an application endpoint. The appropriate AWS WAF applies because AWS WAF inspects and filters HTTP(S) requests with web access-control rules.

Security group: Filters supported resource network traffic using stateful rules. This does not address the need for A website owner wants to reduce common web exploits such as SQL injection patterns at an application endpoint. The appropriate AWS WAF applies because AWS WAF inspects and filters HTTP(S) requests with web access-control rules.

AWS Shield provides DDoS protection against supported traffic attacks. This does not address the need for A website owner wants to reduce common web exploits such as SQL injection patterns at an application endpoint. The appropriate AWS WAF applies because AWS WAF inspects and filters HTTP(S) requests with web access-control rules.

AWS WAF: Filters HTTP(S) web requests by configured rules. That does not meet the requirement: A public service needs protection against common distributed denial-of-service attacks.

Amazon Inspector: Assesses workloads for vulnerabilities. That does not meet the requirement: A public service needs protection against common distributed denial-of-service attacks.

AWS Artifact supplies compliance reports and agreements. That does not meet the requirement: A public service needs protection against common distributed denial-of-service attacks.

AWS WAF: Filters HTTP(S) web requests by configured rules. This does not address the need for A public service needs protection against common distributed denial-of-service attacks. The appropriate AWS Shield applies because AWS Shield provides managed network and transport-layer DDoS protection for supported AWS resources.

Amazon Inspector: Assesses workloads for vulnerabilities. This does not address the need for A public service needs protection against common distributed denial-of-service attacks. The appropriate AWS Shield applies because AWS Shield provides managed network and transport-layer DDoS protection for supported AWS resources.

AWS Artifact supplies compliance reports and agreements. This does not address the need for A public service needs protection against common distributed denial-of-service attacks. The appropriate AWS Shield applies because AWS Shield provides managed network and transport-layer DDoS protection for supported AWS resources.

Amazon Inspector: Assesses workloads for vulnerabilities. That does not meet the requirement: A technical reviewer evaluates this need: An ecommerce platform wants AWS-managed DDoS defenses for its internet-facing application.

AWS Artifact supplies compliance reports and agreements. That does not meet the requirement: A technical reviewer evaluates this need: An ecommerce platform wants AWS-managed DDoS defenses for its internet-facing application.

AWS WAF: Filters HTTP(S) web requests by configured rules. That does not meet the requirement: A technical reviewer evaluates this need: An ecommerce platform wants AWS-managed DDoS defenses for its internet-facing application.

Amazon Inspector: Assesses workloads for vulnerabilities. This does not address the need for An ecommerce platform wants AWS-managed DDoS defenses for its internet-facing application. The appropriate AWS Shield applies because AWS Shield provides managed network and transport-layer DDoS protection for supported AWS resources.

AWS WAF: Filters HTTP(S) web requests by configured rules. This does not address the need for An ecommerce platform wants AWS-managed DDoS defenses for its internet-facing application. The appropriate AWS Shield applies because AWS Shield provides managed network and transport-layer DDoS protection for supported AWS resources.

AWS Artifact supplies compliance reports and agreements. This does not address the need for An ecommerce platform wants AWS-managed DDoS defenses for its internet-facing application. The appropriate AWS Shield applies because AWS Shield provides managed network and transport-layer DDoS protection for supported AWS resources.

AWS KMS manages encryption keys and related permissions. That does not meet the requirement: A company wants to deploy consistent firewall rules across multiple AWS accounts and resources.

AWS Artifact supplies compliance reports and agreements. That does not meet the requirement: A company wants to deploy consistent firewall rules across multiple AWS accounts and resources.

AWS CloudTrail records API requests and account management events. That does not meet the requirement: A company wants to deploy consistent firewall rules across multiple AWS accounts and resources.

AWS CloudTrail records API requests and account management events. This does not address the need for A company wants to deploy consistent firewall rules across multiple AWS accounts and resources. The appropriate AWS Firewall Manager applies because Firewall Manager centrally manages compatible protection policies across an AWS organization.

AWS KMS manages encryption keys and related permissions. This does not address the need for A company wants to deploy consistent firewall rules across multiple AWS accounts and resources. The appropriate AWS Firewall Manager applies because Firewall Manager centrally manages compatible protection policies across an AWS organization.

AWS Artifact supplies compliance reports and agreements. This does not address the need for A company wants to deploy consistent firewall rules across multiple AWS accounts and resources. The appropriate AWS Firewall Manager applies because Firewall Manager centrally manages compatible protection policies across an AWS organization.