ExamPark
Course menuSCS-C03

Exams / SCS-C03 / Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda) / Question 1

SCS-C03 practice question: Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda) (1 of 2)

Incident Response A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A media streamer keeps unreleased episodes in Amazon S3 buckets. A developer's script sometimes applies a public-read setting to one of these buckets by mistake. Other buckets are public on purpose, because they host a static help website, and those buckets carry the tag public-site=true.

The security team wants any new public exposure of a bucket without that tag reversed within ten minutes, with an audit record of the change. The team has no budget for servers, and the fix must not touch the tagged website buckets.

Which solution meets these requirements?

Choose one answer.

  1. A. Create an EventBridge rule for bucket ACL and policy change events that starts an Automation runbook. The runbook skips buckets tagged public-site=true and turns on Block Public Access for the others.
  2. B. Run a Lambda function every hour that scans every bucket, removes public ACLs from buckets without the tag, records each change in a log file, and emails the team a summary of the changes.
  3. C. Turn on S3 Block Public Access at the account level, so that no bucket in the account can be made public, including the static help website buckets that the company serves to customers.
  4. D. Create an EventBridge rule that sends an email to the bucket owner whenever a public setting appears, and rely on the owner to restore the private settings of the bucket promptly.
Show the answer and explanation

Answer: A

  • A. Right: Correct. The rule reacts within minutes of the change, and the runbook reads the bucket tags, so the website buckets are left alone. Systems Manager keeps an execution history as the audit record, and no server is needed. Learn more: Systems Manager Automation (opens in a new tab)
  • B. Wrong: The hourly scan can take up to an hour to reverse a change, which misses the ten-minute requirement. The function must also be written to skip the tagged websites, which adds risk to the fix.
  • C. Wrong: This stops public exposure quickly, but it also breaks the static help website, which must stay public. The requirement says the fix must not touch the tagged website buckets.
  • D. Wrong: The alert is fast, but the owner must act by hand, and the requirement is an automatic reversal within ten minutes. An email also leaves no runbook record of the change.

Explanation

An event-driven runbook reacts within minutes, and checking the tag inside the runbook protects the public website buckets, because an event pattern cannot read bucket tags. Block Public Access on the exposed bucket reverses the change and leaves an execution record. A scheduled scan, an account-wide block and an email to the owner each fail a stated requirement.

Automatic remediation of a security event through EventBridge A security finding or API call event, from services such as GuardDuty, Security Hub CSPM or CloudTrail, matches an EventBridge rule. The rule starts a Systems Manager Automation runbook or Lambda function through an IAM role, which fixes the resource and notifies the team. Security event finding or API call GuardDuty, Security Hub, CloudTrail API calls EventBridge rule event pattern matches type, severity or resource Automation runbook or Lambda function started through an IAM role Resource fixed and team notified within minutes, with a record of the run
An ACL or policy change event starts the runbook, which checks the bucket's tag and turns on Block Public Access.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free SCS-C03 practice examPractice Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda)All Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda) questions

Want more on Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda)? The 5 full-length practice sets have 7 more Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets