SCS-C03 practice question: Secure infrastructure as code (StackSets, CloudFormation Guard, Hooks)
Security Foundations and Governance A free question from our original SCS-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A retail chain creates a new AWS account for each store-systems project, and the organization's account process places each one in the right OU. Every new account must get a baseline of CloudTrail logging, a GuardDuty detector, and an IAM role that the security team uses for audits, all before the first developer signs in.
The security team does not want to run a script after each account is created, and it does not want to store long-term deployment keys. New accounts placed in the OU should receive the baseline automatically.
Which solution meets these requirements?
Choose one answer.
AA. Create a self-managed CloudFormation StackSet from the management account, and create deployment roles in each member account with a script that runs after each account is created. Target the StackSet at the OU account IDs.
BB. Create a service-managed CloudFormation StackSet from the organization management account, target the OU, and turn on automatic deployment. New accounts moved into that OU then receive the stacks without a manual step.
CC. Deploy the baseline with Terraform from a central pipeline that runs every night. The pipeline discovers new accounts through the Organizations API, and applies the baseline using access keys for each new account.
DD. Add the baseline as a launch template in each store project account, and ask developers to launch it on their first day. The security team checks compliance with an AWS Config rule each week.
Show the answer and explanation
Answer: B
A. Wrong: Self-managed StackSets need deployment roles in every account, created by a script that runs after each account is made. The security team wants no per-account step, and this script is exactly that step.
B. Right: Correct. Service-managed StackSets create the roles needed in each account, and automatic deployment applies the stacks to accounts that join the target OU. No long-term keys or per-account scripts are required. Learn more: Enable automatic deployment for StackSets (opens in a new tab)
C. Wrong: A nightly pipeline leaves new accounts unprotected for hours, which misses the before-first-sign-in requirement. Storing access keys for each account breaks the rule against long-term deployment keys.
D. Wrong: A launch template configures instances, not account-level logging or detection, and it depends on developers acting. Weekly checks find gaps after the first sign-in, which the requirement forbids.
Explanation
Service-managed StackSets deploy stacks to accounts in target OUs, including accounts that join later, without per-account deployment roles or scripts. The self-managed script, the nightly pipeline with access keys, and the launch template each leave a gap or need long-term keys.
Want more on Secure infrastructure as code (StackSets, CloudFormation Guard, Hooks)? The 5 full-length practice sets have 5 more Secure infrastructure as code (StackSets, CloudFormation Guard, Hooks) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →