SCS-C03 Exam Questions and Answers

Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.

Rate-based rules in AWS WAF automatically track the number of requests from specific IP addresses over a rolling five-minute period. When a threshold is breached, the WAF can automatically block requests from those IPs, providing an effective first line of defense against automated brute-force login attempts.

Configure CloudWatch Logs agents to stream system auth logs to CloudWatch.

Streaming system authentication logs (such as /var/log/auth.log) to CloudWatch Logs allows for the creation of metric filters. These filters can trigger CloudWatch Alarms when a specific number of failed login attempts are detected within a time window, alerting security teams to brute-force activity occurring on the instance.

AWS Security Hub.

Security Hub is specifically designed to aggregate, organize, and prioritize security alerts and findings from various AWS services and partner products. It offers a centralized dashboard that provides a comprehensive view of the security state across all accounts in an AWS Organization, fulfilling the requirement.

AWS GuardDuty.

GuardDuty uses machine learning, anomaly detection, and integrated threat intelligence to monitor and protect AWS accounts. It is specifically designed to identify anomalous activity, such as unusual API calls or unauthorized access to sensitive resources like S3 buckets, based on baseline behavioral patterns.

Amazon CloudWatch Metric Filters and Alarms.

CloudWatch Metric Filters allow users to search CloudTrail logs for specific patterns, such as denied API calls. Once a pattern is matched, a metric can be incremented and an alarm can be configured to notify security personnel, providing an automated way to detect high-risk denied actions.

AWS Config.

AWS Config provides managed rules that continuously monitor resource configurations. By evaluating instances against the 'ec2-instance-no-public-ip' rule, it can automatically detect and alert on any instance that has an assigned public IP, fulfilling the requirement for automated detection of network exposure.

IAM Credential Report.

The IAM Credential Report generates a report that lists all users and includes fields like 'password_last_used' and 'access_key_1_last_used'. This is the most direct and efficient way to identify users who haven't performed any actions in a specific time frame for compliance auditing.

Apply a bucket policy that denies all 's3:*' actions for all users except the security incident response role.

Applying a restrictive policy effectively contains the breach by blocking all traffic while ensuring the security team retains access for forensic examination. This preserves the environment's state for analysis while immediately halting ongoing unauthorized data exfiltration, satisfying the containment requirement without destroying the underlying data or audit logs.

The policy uses 'Allow' instead of 'Deny', allowing bypass by any identity with broad IAM permissions.

Because the policy is an Allow statement, it acts as an additional permission grant rather than a restriction. IAM entities with sufficient permissions elsewhere in the account are not restricted by this policy because it does not contain a Deny rule to supersede those identity-based permissions.

Restore the affected volumes from the latest pre-incident EBS snapshots.

Restoring from snapshots is the most efficient and reliable method to recover from a ransomware incident. It ensures the integrity of the data by rolling back to a known-good state before the encryption occurred, effectively bypassing the malicious encryption and allowing the team to resume operations quickly.

AWS Security Hub

Security Hub aggregates security findings from across AWS services and partner products into a single location. It provides a centralized view of an organization's security posture and compliance status, which is vital for prioritizing and managing incident response workflows during a security event.

Amazon Detective

Amazon Detective simplifies the investigative process by automatically collecting and correlating data from CloudTrail, VPC Flow Logs, and GuardDuty. It provides a visual representation of relationships between resources and IP addresses, helping responders quickly identify the scope and nature of security incidents.

Aggregate logs into a dedicated, centralized security account.

Centralizing logs into a dedicated account provides an immutable and secure audit trail. By separating the log storage from the production environment, the organization ensures that logs are protected even if an attacker gains administrative privileges within a production account, facilitating faster and more reliable incident investigations.

Modify the security groups attached to the EC2 instance to block all inbound and outbound traffic while keeping the operating system running.

Applying a restrictive security group containing explicit deny rules or zero allowable traffic isolates the instance instantly. Keeping the instance powered on maintains the volatile memory state, allowing forensic specialists to capture RAM dumps safely before shutdown.

The connection will be denied because the NACL Rule 100 is evaluated first.

NACLs process rules in order starting from the lowest number. Because Rule 100 matches the source IP and port with a 'DENY' action, the packet is immediately discarded. The higher-numbered 'ALLOW' rule and the permissive Security Group rules are ignored because the first matching NACL rule takes precedence.

Deploy a Gateway Load Balancer and create a GWLB endpoint in the traffic-originating subnets.

A Gateway Load Balancer simplifies the insertion of security appliances into the network path. By using GWLB endpoints and updating VPC route tables, traffic is transparently routed to the firewall fleet. The GWLB ensures high availability and flow consistency, which is essential for stateful firewalls to function correctly.

AWS Systems Manager Session Manager

Session Manager allows for secure instance management without bastion hosts. Since it doesn't require inbound ports to be open in security groups, it significantly reduces the attack surface. All sessions are logged to CloudWatch Logs or S3, providing detailed visibility into administrative actions for compliance and security auditing.

Stateful rule group with domain list filtering.

Stateful rule groups can be configured with domain lists, which use the Suricata engine to inspect the SNI in TLS handshakes or the Host header in HTTP requests. This allows the firewall to block or allow traffic based on fully qualified domain names (FQDNs) rather than just static IP addresses.

Enable 'Appliance Mode' on the Transit Gateway VPC attachment for the Security VPC.

Appliance Mode ensures that the Transit Gateway maintains flow symmetry by sending both the request and response traffic through the same Availability Zone in the Security VPC. This is critical for stateful firewalls to correctly track connections and prevent packets from being dropped due to out-of-order or missing state information.

Configure a default route (0.0.0.0/0) in the spoke VPC subnets pointing to the Transit Gateway.

To centralize outbound traffic, spoke VPCs must be configured to send all non-local traffic to the Transit Gateway. By setting the default route to the TGW, any traffic destined for the internet is handed off to the central hub, where it can be redirected to the inspection firewall fleet.

It prevents any access to the bucket from outside the specified VPC endpoint.

Because 'Deny' overrides 'Allow' in AWS evaluation logic, this policy effectively blocks all traffic—including from the AWS Management Console or other VPCs—unless it originates from vpce-1a2b3c4d. This is a common pattern for securing highly sensitive data against accidental exposure or credential theft.

Apply SCPs at the root level to restrict specific AWS services in member accounts.

SCPs applied at the root or organizational unit level are effective at enforcing global compliance standards. They restrict the maximum permissions available to any user or role within the account, ensuring that sensitive services or regions are off-limits, which is fundamental for maintaining a secure and compliant AWS multi-account environment.

Use IAM Permission Boundaries on all developer-created roles.

Permission Boundaries are essential for delegating administrative tasks securely. By setting a boundary on a role, you ensure that even if a developer adds excessive permissions to that role, the effective permissions are capped by the boundary. This allows for safe delegation while maintaining strict control over maximum possible access levels.

The user does not have the 'Department' tag attached to their IAM principal.

The Condition uses StringNotEquals. If the tag is missing, the condition evaluates to true for the Deny, because 'null' is not equal to 'Finance'. Therefore, the Deny policy takes effect. ABAC implementations often fail when principals lack the necessary tags required by the policy logic, resulting in unexpected access denial.

Assign an IAM role to the EC2 instance via an instance profile.

Using IAM roles with instance profiles is the gold standard for EC2 security. It provides temporary, short-lived credentials that are automatically rotated by the AWS environment. The application uses the AWS SDK to retrieve these credentials, ensuring no sensitive data is stored on the disk or exposed in the code.

Enable multi-factor authentication (MFA) on the root account.

MFA is the most critical defense against compromised root credentials. Without MFA, a leaked password grants full control over the AWS account. Requiring a hardware or virtual MFA device adds a necessary layer of protection, ensuring that even if the password is stolen, the attacker cannot access the account.

Delete the root access keys and do not create new ones.

Access keys for the root account are unnecessary for day-to-day operations and present a major security risk. Deleting them ensures that there is no programmatic way to compromise the account using long-term credentials, forcing all administrative interaction to go through the console where MFA is required.

Set up a strong password and rotate it at least once every 90 days.

Even though root is rarely used, it must have a complex, unique password that is regularly rotated. This prevents brute-force attacks and limits the utility of a leaked password. Regular rotation, combined with MFA, ensures that the root account remains as secure as possible against unauthorized access attempts.

aws iam list-attached-user-policies --user-name <username>

This is the correct CLI command to list all managed policies attached to an IAM user. Managed policies are the most common way to grant permissions, so listing them is the first step in assessing a user's permission set. This command provides a clear, concise list for audit reporting.

Use an SCP to explicitly deny 'cloudtrail:StopLogging' for the organization.

SCPs are the perfect tool for organizational-wide guardrails. By applying a 'Deny' on 'cloudtrail:StopLogging' at the organization level, you ensure that no user or role, including administrative roles, can disable CloudTrail. This provides a central, immutable security control that meets stringent regulatory requirements for consistent logging across the entire enterprise.

Enable RDS encryption using a customer-managed key during instance creation.

Enabling encryption during the RDS instance launch is the only way to ensure the underlying storage volume is encrypted. By selecting a customer-managed key, you gain the authority to manage the key's lifecycle, including setting the necessary rotation policies to meet your specific security requirements.

Configure the customer-managed KMS key to perform automatic annual key rotation.

Customer-managed keys support automatic rotation, which periodically generates new backing key material. This process is transparent to RDS and ensures the data remains protected. Configuring this for your customer-managed key fulfills the requirement to keep the cryptographic material refreshed on an annual basis without manual intervention.

Share the snapshot and update the KMS key policy to permit usage by the partner.

Sharing the snapshot makes it visible to the partner, but they cannot decrypt it without access to the key. Updating the KMS key policy allows the partner's IAM entities to use the key for cryptographic operations, which is required to successfully restore or use the shared encrypted snapshot.

Perform manual key rotation by creating a new key every 90 days.

Since automatic rotation is fixed at 365 days, manual rotation is the only way to satisfy a 90-day requirement. This involves creating a new KMS key, updating application references, and retaining the previous key for decryption of legacy data, ensuring compliance with internal security policies.

Update the IAM policy in Account A and the KMS key policy in Account B.

This dual-policy configuration is required for cross-account access. The key policy grants permission to the external account's role, and the IAM policy ensures the role has permission to exercise that grant. This combination follows the principle of least privilege while enabling necessary cross-account functionality.

VPC Endpoint Policies

VPC Endpoint Policies are attached to VPC endpoints and allow you to define which AWS service actions are permitted. This is a highly effective way to prevent unauthorized data exfiltration by ensuring that only approved AWS services can be accessed from within your VPC.

Snapshots and automated backups of an encrypted RDS instance are automatically encrypted using the same KMS key.

When you encrypt an RDS DB instance, all its subsequent snapshots and automated backups are automatically encrypted using the same KMS key as the parent instance. This ensures consistent data protection throughout the entire lifecycle of the data, including recovery points and archival storage in Amazon S3.

Read replicas of an encrypted RDS instance must also be encrypted using the same KMS key as the primary instance.

For RDS MySQL, MariaDB, and PostgreSQL, if the primary instance is encrypted, all read replicas must also be encrypted. While they usually use the same KMS key, they must at least be encrypted to maintain the security posture of the replicated data across different availability zones or regions.

AWS Security Hub

Security Hub provides a comprehensive view of security alerts and compliance status across an entire AWS Organization. It integrates with native AWS services and third-party partner products to normalize data into the AWS Security Finding Format, facilitating efficient monitoring, prioritization, and automated remediation workflows for security teams.

Create an SCP that denies s3:PutObject if x-amz-server-side-encryption is not present.

This SCP effectively prevents any user or service from uploading data to S3 without specifying server-side encryption. By denying the write action at the account boundary level, you ensure that even if a bucket policy is missing, the data cannot be stored in an unencrypted state.

Deploy an SCP that denies s3:CreateBucket unless the request includes default encryption configuration.

This policy ensures that developers cannot create buckets that lack encryption settings at the time of creation. By controlling the creation process, the security team enforces a 'secure by default' posture across the entire organization, preventing non-compliant infrastructure from ever existing within the environment.

The condition only checks the header if it exists in the request.

In AWS IAM policy logic, if a header is missing from the request, the 'StringNotEquals' condition does not evaluate to true, so the 'Deny' effect is not applied. The request proceeds as if the condition were not there, allowing unencrypted uploads to bypass the security check.

AWS CloudTrail

CloudTrail is specifically designed to log all API calls made within an AWS account. It records the identity of the caller, the time of the call, the source IP, and the request parameters, providing a complete audit trail that is essential for security auditing and operational troubleshooting.

Use AWS Config rules to monitor tagging compliance.

AWS Config is designed for continuous assessment and compliance monitoring. By setting up a 'required-tags' rule, the organization can automatically audit all resources for the presence of the required 'Department' tag, enabling automated reporting and alerting on any resources that fail to meet the company's tagging policy.

Apply the Principle of Least Privilege.

This principle is the cornerstone of IAM security. By granting only the specific permissions needed for a job, you limit the potential for error and malicious activity. This approach is standard for all security governance frameworks, ensuring that every identity is constrained to its legitimate scope of operation.