SCS-C03 Practice Test 2 — 10 Questions

Question 1

Which THREE of the following resource types are currently supported by IAM Access Analyzer to identify potential public or cross-account access?

Accepted Answer

Amazon S3 Buckets. IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. It does this by analyzing resource-based policies. This helps security teams identify unintended access to sensitive data or infrastructure and is a critical part of the 'Detection' domain.

Answer

Amazon DynamoDB Tables

Answer

Amazon EC2 Security Groups

Question 2

An organization's security team detects an active data exfiltration event originating from a compromised Amazon EC2 Linux instance. The instance contains critical forensic evidence that must be preserved. What is the most effective immediate containment action that prevents external communication while retaining the memory state for forensic analysis?

Accepted Answer

Modify the security groups attached to the EC2 instance to block all inbound and outbound traffic while keeping the operating system running.. Isolating the compromised instance using a dedicated security group ensures complete network containment while preventing any state loss. Stopping or terminating the instance would wipe volatile RAM memory, permanently destroying crucial artifacts required for deep forensic investigation. Preserving memory is critical for identifying intrusion vectors and achieving root cause analysis compliance during major security incidents.

Answer

Stop the EC2 instance immediately to disconnect it from the network and preserve the attached Amazon EBS root volume for offline examination.

Answer

Terminate the compromised instance and launch a replacement instance from a clean AMI to maintain high availability and service uptime.

Answer

Detach the primary Amazon EBS volume from the running instance and attach it to an isolated analysis instance for live scanning.

Question 3

A security analyst needs to detect potential exfiltration of sensitive data from an S3 bucket that has public access blocked. Which Amazon GuardDuty feature should be configured to detect anomalous data access patterns by internal IAM users?

Accepted Answer

Activate S3 Protection in Amazon GuardDuty.. GuardDuty S3 Protection analyzes CloudTrail S3 data events to detect anomalous activities, such as unusual access patterns or data access from unexpected locations. This feature is essential for identifying compromised identities that attempt to mass-download objects. By focusing on data-level events, it provides visibility into malicious behavior that standard API monitoring might miss, ensuring that even authorized users are monitored for activity that deviates from their historical baseline profile.

Answer

Enable VPC Flow Logs analysis within GuardDuty.

Answer

Configure AWS CloudTrail Insights for the S3 management events.

Answer

Deploy Macie to monitor S3 bucket access logs.

Question 4

An organization is concerned about detecting potential SQL injection attacks against their web application hosted on Application Load Balancer. Which service provides the best native detection capability?

Accepted Answer

AWS WAF with SQL injection rule sets.. AWS WAF provides native inspection of web traffic and can detect common patterns of SQL injection. It is the most effective tool to stop these attacks at the edge, before they reach the backend application. Proper configuration of WAF rules is a critical detective and preventative control, ensuring that malicious payloads are identified and filtered in real-time, which protects application databases from compromise and unauthorized data access.

Answer

Amazon GuardDuty.

Answer

Amazon Inspector.

Answer

AWS CloudTrail.

Question 5

An organization wants to improve their ability to respond to security incidents. Which TWO of the following services provide centralized visibility and management for security findings?

Accepted Answer

AWS Security Hub. AWS Security Hub and Amazon Detective are designed to aggregate, manage, and investigate security data. Security Hub acts as the central pane of glass for findings from various AWS services, while Detective provides the visualization tools needed to investigate the root cause of those findings. Together, they streamline the identification and triage process, allowing responders to move quickly from alert to conclusion during a security incident.

Answer

Amazon CloudWatch

Answer

AWS Artifact

Answer

AWS Systems Manager

Question 6

A security engineer needs to detect when an EC2 instance is launched with an unapproved Amazon Machine Image (AMI). Which AWS service should be used to automate this detection?

Accepted Answer

AWS Config.. AWS Config is the ideal tool for continuous configuration monitoring. By creating a custom rule, you can evaluate the 'imageId' attribute of all EC2 instances upon launch. If an instance uses an AMI that is not on the approved list, Config marks it as non-compliant and can trigger automated remediation. This ensures organizational compliance for image standards and prevents the usage of hardened, unapproved, or potentially vulnerable software instances.

Answer

Amazon GuardDuty.

Answer

AWS CloudTrail.

Answer

Amazon Inspector.

Question 7

An organization experiences a ransomware attack that encrypts data across several EBS volumes. The team needs to restore operations as quickly as possible. Which strategy minimizes the impact of the incident while ensuring data integrity?

Accepted Answer

Restore the affected volumes from the latest pre-incident EBS snapshots.. Restoring from the most recent known-good EBS snapshot allows for the rapid recovery of data in a clean state. By leveraging snapshots, the team bypasses the need to decrypt the ransomware-affected data, which is time-consuming and often impossible without the attacker's key. This method is the standard recovery procedure for persistent storage threats in AWS, providing a clear path back to service availability after containment is complete.

Answer

Attempt to brute-force the ransomware decryption key using high-performance compute instances.

Answer

Copy the encrypted volumes to a new account and run a vulnerability scan.

Answer

Format the EBS volumes and manually copy data from the underlying S3 logs.

Question 8

An organization is using AWS Secrets Manager to store database credentials. The security policy requires that these credentials be rotated every 30 days. The database is hosted on Amazon RDS. What is the most secure and automated way to implement this requirement?

Accepted Answer

Enable rotation in Secrets Manager and use a provided Lambda template to update the RDS credentials.. AWS Secrets Manager integrates directly with Lambda to automate the rotation of secrets. For supported services like Amazon RDS, AWS provides pre-written Lambda templates that handle the complex logic of updating the password in the database and the secret value in Secrets Manager simultaneously, ensuring no service interruption occurs during the process.

Answer

Use an Amazon EventBridge rule to trigger a manual password reset on the RDS instance every 30 days.

Answer

Store the credentials in an S3 bucket with versioning and use a Lifecycle policy to rotate the files.

Answer

Configure the RDS instance to automatically pull new credentials from Secrets Manager using IAM roles.

Question 9

A company requires all outbound internet traffic from its VPC to be inspected by a fleet of third-party firewall appliances. The solution must scale horizontally and ensure that traffic is symmetric, meaning requests and responses pass through the same firewall instance. Which architecture should the security engineer implement?

Accepted Answer

Deploy a Gateway Load Balancer and create a GWLB endpoint in the traffic-originating subnets.. Gateway Load Balancer (GWLB) is designed for deploying, scaling, and managing third-party virtual appliances. It uses the GENEVE protocol to wrap packets and maintain flow affinity, ensuring that both directions of a traffic flow are handled by the same appliance, which is critical for stateful inspection and security monitoring.

Answer

Deploy the firewalls behind an Application Load Balancer and use host-based routing.

Answer

Use a Transit Gateway with VPC Peering and ECMP enabled for load balancing.

Answer

Set up a Network Load Balancer with Proxy Protocol enabled for the firewall instances.

Question 10

Which THREE actions are essential to harden an Amazon EC2 Linux instance against unauthorized SSH access?

Accepted Answer

Disable password authentication in the '/etc/ssh/sshd_config' file.. Hardening SSH requires reducing the attack surface. Disabling password-based authentication forces the use of key pairs, which are more secure. Disabling root login prevents attackers from gaining full system privileges immediately. Implementing AWS Systems Manager Session Manager eliminates the need for open SSH ports (port 22) entirely, providing a highly secure, audited, and ephemeral way to manage instances without exposing them to the internet.

Answer

Change the default SSH port from 22 to a non-standard port like 2222.

Answer

Install a third-party antivirus agent on every EC2 instance.