SCS-C02 Exam Dumps : AWS Certified Security - Specialty

Create an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to the IAM account root user.

Create an S3 bucket policy in the specified destination account for the CloudTrail trail that prohibits configuration changes from the IAM account root user in the source account.

Create an SCP that prohibits changes to the specific CloudTrail trail and apply the SCP to theappropriate organizational unit or account in Organizations.

Create an IAM policy that prohibits changes to the specific CloudTrail trail and apply the policy to a new IAM group. Have team members use individual IAM accounts that are members of the new IAM group.

Remove the existing NAT gateway. Create a new NAT gateway that only the application server subnets can use.

Configure the DB instanceג€™s inbound network ACL to deny traffic from the security group ID of the NAT gateway.

Modify the route tables of the DB instance subnets to remove the default route to the NAT gateway.

Configure the route table of the NAT gateway to deny connections to the DB instance subnets.

Delete the access keys for the account root user in every account.

Create an admin IAM user with administrative privileges and delete the account root user in every account.

Implement a strong password to help protect account-level access to the IAM Management Console by the account root user.

Enable multi-factor authentication (MFA) on every account root user in all accounts.

Create a custom IAM policy to limit permissions to required actions for the account root user and attach the policy to the account root user.

Attach an IAM role to the account root user to make use of the automated credential rotation in IAM STS.