Exam AWS Certified Security - Specialty SCS-C02 topic 1 question 301 discussion

Exam question from Amazon's AWS Certified Security - Specialty SCS-C02

Question #: 301
Topic #: 1

[All AWS Certified Security - Specialty SCS-C02 Questions]

A company is running its application on AWS. Malicious users exploited a recent promotion event and created many fake accounts.

The application currently uses Amazon CloudFront in front of an Amazon API Gateway API. AWS Lambda functions serve the different API endpoints. The GET registration endpoint is behind the path of /store/registration. The URI for submission of the new account details is at /store/newaccount.

A security engineer needs to design a solution that prevents similar exploitations for future promotion events.

Which combination of steps will meet these requirements? (Choose two.)

A. Create an AWS WAF web ACL. Add the AWSManagedRulesACFPRuleSet rule group to the web ACL. Associate the web ACL with the CloudFront distribution.
B. Create an AWS WAF web ACL. Add a rate limit rule to the web ACL. Include a RateBasedStatement entry that has a SearchString value that points to /store/registration.
C. Specify /store/registration as the registration page path. Specify /store/newaccount as the account creation path.
D. Enable AWS Shield Advanced for the account that hosts the CloudFront distribution. Configure a DNS-specific custom mitigation that uses the Shield Response Team (SRT) for /store/newaccount.
E. Enable Amazon GuardDuty for the account that hosts the CloudFront distribution. Enable Lambda Protection for the Lambda functions that answer calls to /store/registration and /store/newaccount.

Show Suggested Answer

Suggested Answer: AB 🗳️

by beriliu at April 15, 2025, 7:58 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

mnsait

3 weeks, 2 days ago

Selected Answer: AE

I will go with A and E Rationale: Option A helps detect and prevent malicious users with specific patterns associated with vulnerabilities with web applications GuardDuty Lambda Protection can detect and prevent malicious attempts. Lambda is being used in this context.

upvoted 1 times

...