SCS-C02 Exam Dumps : AWS Certified Security - Specialty

The AWS Encryption SDK supports client-side encryption and cryptographic signing, enabling applications to protect and verify sensitive data before it is transmitted or stored. This allows end-to-end protection and helps detect unauthorized data changes using signatures.

While both AWS Encryption SDK and the DynamoDB Encryption Client provide similar functionalities, the AWS Encryption SDK is broader in scope and better supported for generalized end-to-end encryption patterns.

This solution ensures:

Data protection in transit and at rest

Integrity assurance through signing

Compliance with best practices under the Data Protection domain.

Note that the IP is known and the question wants us to deny access from that particular address and so we can use IP set match policy of WAF to block access.

The correct answer is A because it allows the security engineer to add the X-Frame-Options header to the HTTPS responses from the application origin without modifying the origin itself. A Lambda@Edge function is a Lambda function that runs in response to CloudFront events, such as viewer request, origin request, origin response, or viewer response. By configuring the function to runin response to the origin response event, the security engineer can modify the response headers that CloudFront receives from the origin before sending them to the viewer1. The function can include code to add the X-Frame-Options header with the desired value, suchas DENY or SAMEORIGIN, to prevent frame-related cross-site scripting attacks2.

The other options are incorrect because they are either less efficient or less secure than option A. Option B is incorrect because configuring the Lambda@Edge function to run in response to the viewer request event is not optimal, as it adds latency to the request processing and does not modify the response headers that CloudFront receives from the origin. Option C is incorrect because adding X-Frame-Options to custom headers in the origin settings does not affect the response headers that CloudFront sends to the viewer. Custom headers are only used to send additional information to the origin when CloudFront forwards a request3. Option D is incorrect because customizing the EC2 hosted application to add the X-Frame-Options header to the responses requires changing the origin code, which may not be feasible or desirable for the security engineer.