SCS-C03 Practice Exam 2 — 20 Questions

Question 1

A company is implementing a new internal web application and needs to use SSL/TLS certificates. Due to regulatory requirements, the certificates must be issued by a private Certificate Authority (CA) managed by the company, rather than a public CA. Which AWS service should be used to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Private Certificate Authority (AWS Private CA). AWS Private Certificate Authority (AWS Private CA) allows organizations to create a private CA hierarchy and issue certificates for internal use. This is essential for securing communication between internal services, devices, and users where a public trust chain is not required or is explicitly prohibited by security policies.

Answer

AWS Certificate Manager (ACM) with public certificates.

Answer

AWS CloudHSM to store and manage the private keys of the web application.

Answer

AWS Secrets Manager to store and rotate the SSL/TLS certificates.

Question 2

A company wants to eliminate the need for managing SSH keys and bastion hosts while still allowing administrators to securely access EC2 instances in private subnets. Which AWS service provides this capability and allows for centralized IAM-based access control?

Accepted Answer

AWS Systems Manager Session Manager. AWS Systems Manager Session Manager provides a secure way to manage EC2 instances without needing to open inbound ports like 22 (SSH) or 3389 (RDP). It uses the SSM Agent to establish a secure tunnel, and access is controlled entirely through IAM policies, providing a robust audit trail of all commands.

Answer

Amazon EC2 Instance Connect

Answer

AWS CloudShell

Answer

AWS Directory Service

Question 3

Refer to the exhibit. An incident responder needs to access the production-data bucket to investigate a breach. They apply this policy to their IAM user, but get 'Access Denied' when running 'aws s3 ls s3://production-data'. Why?

Accepted Answer

The policy is missing the 'kms:Decrypt' permission for encrypted objects.. The policy provided only grants the 's3:ListBucket' permission, which allows the user to see the objects within the bucket. However, the 'aws s3 ls' command often requires additional permissions, such as 's3:GetBucketLocation' or 's3:ListBucket'. More importantly, if the bucket is encrypted with a KMS key, the user must also have 'kms:Decrypt' permissions, which are absent here. This is a common stumbling block in granular IAM policy management.

Answer

The user is missing the 's3:GetObject' permission.

Answer

The resource ARN is incorrectly formatted for S3.

Answer

The user needs the 's3:PutObject' permission to list files.

Question 4

A security engineer is hardening an Amazon VPC environment. To achieve defense-in-depth, the engineer needs to implement network filtering mechanisms that apply stateful inspection at the instance level and stateless inspection at the subnet boundary. Which TWO AWS features should the engineer configure to meet these requirements? (Choose two)

Accepted Answer

Amazon VPC security groups. Security groups provide stateful packet filtering directly at the elastic network interface level, automatically allowing return traffic for established connections. Network Access Control Lists (NACLs) provide stateless packet filtering at the subnet boundary, requiring explicit rules for both inbound and outbound traffic. Using both provides complementary layers of defense.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon Route 53 Resolver DNS Firewall

Question 5

Your company has a multi-account environment managed by AWS Organizations. A security incident reveals that a member account has been compromised. You must prevent the attacker from disabling CloudTrail or deleting logs in that account while maintaining central visibility. What is the most effective approach?

Accepted Answer

Use an Service Control Policy (SCP) to deny CloudTrail and log deletion.. Implementing an SCP at the Organizational Unit level is the most effective way to enforce security guardrails that cannot be circumvented by account administrators. By explicitly denying the ability to modify CloudTrail or S3 logging buckets, you ensure that the audit trail remains intact regardless of the level of access the attacker gains within the member account, thereby preserving forensic integrity across the enterprise environment.

Answer

Create an IAM policy in the compromised account to deny CloudTrail deletion.

Answer

Use AWS Config Rules to automatically re-enable CloudTrail if disabled.

Answer

Enable S3 Object Lock in compliance mode for all log buckets.

Question 6

A security incident indicates an EC2 instance is likely compromised and communicating with a C2 server. The security team needs to perform memory forensics and isolate the instance while preserving evidence. Which TWO actions should the team perform?

Accepted Answer

Snapshot the EBS volumes attached to the instance.. In an incident response scenario, capturing the volatile state of an instance is vital before isolation or termination occurs. Snapshotting the EBS volume allows for offline disk forensics, while memory dumps capture active threats that do not persist on disk. These actions follow standard digital forensics procedures to ensure evidence integrity, enabling a thorough investigation into the root cause of the compromise without losing critical data residing only in RAM.

Answer

Terminate the EC2 instance immediately to stop the data exfiltration.

Answer

Attach a new IAM role with administrative privileges to the instance.

Answer

Remove the VPC flow logs to save storage costs during the investigation.

Question 7

A company needs to log all DNS queries made by EC2 instances within their VPC to identify potential data exfiltration via DNS tunneling. Which feature should the security engineer enable?

Accepted Answer

Route 53 Resolver Query Logging.. Route 53 Resolver Query Logging allows you to log all DNS queries made by resources within your VPC. This includes queries for public domain names, internal VPC domain names, and even queries made via Route 53 Resolver DNS Firewall, providing the visibility needed to detect anomalies like DNS tunneling.

Answer

VPC Flow Logs for all subnets.

Answer

CloudTrail management events.

Answer

Amazon GuardDuty DNS Security.

Question 8

Refer to the exhibit. An IAM user with the 'Finance' tag is trying to upload an object to the 'production-data' bucket. The upload is failing. What is the most likely cause?

Accepted Answer

The user does not have the 'Department' tag attached to their IAM principal.. The policy uses a Deny effect with a StringNotEquals condition. If the principal tag 'Department' is anything other than 'Finance', the action is denied. However, if the user's tag is missing or the principal does not have the expected tag during the request, the condition evaluates to true, triggering the Deny. This exhibit highlights how attribute-based access control (ABAC) relies heavily on accurate, consistent tagging across all principal entities.

Answer

The user is missing the required S3 permission in their IAM policy.

Answer

The S3 bucket policy is not allowing the action.

Answer

The S3 bucket is in a different AWS region.

Question 9

A security engineer must protect a multi-tier web application hosted in Amazon EC2 instances inside a private subnet. The application requires outbound internet access to download software updates, but malicious actors must never be able to initiate inbound connections to the instances. Which architecture satisfies these requirements securely?

Accepted Answer

Provision a NAT Gateway in a public subnet, and configure the private subnet route table to direct 0.0.0.0/0 traffic to that NAT Gateway.. Routing outbound traffic through a NAT Gateway ensures that instances can initiate communication with external endpoints while remaining entirely unreachable from the outside. NAT Gateways do not support inbound traffic initiation, providing a robust boundary. This design prevents direct exposure of private workloads, aligning with defense-in-depth principles for infrastructure security in AWS environments.

Answer

Attach an Elastic IP directly to each EC2 instance and remove the default route pointing to the internet gateway in the route table.

Answer

Deploy an Internet Gateway in the private subnet and associate it with the route table used by the application instances.

Answer

Configure a VPC endpoint for every external repository and remove all internet route entries from the VPC route tables entirely.

Question 10

Refer to the exhibit. A security engineer notices that despite the IP restriction, users are still unable to access the S3 bucket from within the corporate network. What is the most likely cause of this issue?

Accepted Answer

The 'Action' element is missing from the policy, causing it to be invalid.. The policy exhibit is incomplete because it lacks the 'Action' field, which is mandatory in AWS IAM and bucket policies. Without defining the action, the policy is syntactically invalid and will result in an 'Access Denied' error. Ensuring policy syntax is correct is a fundamental step in infrastructure security to prevent accidental service outages caused by misconfigured permissions or invalid JSON structures in resource-based policies.

Answer

The VPC endpoint for S3 is not configured to allow the corporate IP range.

Answer

The 'aws:SourceIp' condition key is not supported for Amazon S3 bucket policies.

Answer

The S3 bucket does not have the 'Block Public Access' feature disabled.

Question 11

A security engineer needs to ensure that all EC2 instances are patched against critical vulnerabilities without exposing them to the public internet. Which architecture is most appropriate for this task?

Accepted Answer

Use Systems Manager with VPC endpoints to manage instances in a private subnet.. Using a combination of AWS Systems Manager (SSM) and a VPC endpoint for SSM enables management of instances in private subnets without an Internet Gateway or NAT Gateway. This setup allows the SSM agent to communicate with the AWS Systems Manager service securely over the internal AWS network. This is the optimal infrastructure security design for maintaining patching compliance while adhering to strict network isolation requirements.

Answer

Deploy a NAT Gateway in a public subnet to allow outbound traffic for patching.

Answer

Enable public IP addresses on instances and use Security Groups to restrict outbound traffic.

Answer

Manually download patches to an S3 bucket and have instances pull them locally.

Question 12

An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)

Accepted Answer

Apply SCPs at the root level to restrict specific AWS services in member accounts.. Implementing AWS Organizations allows for centralized management and governance. Service Control Policies (SCPs) act as guardrails, defining the maximum permissions allowed within an account, regardless of user identity. Combining SCPs with IAM Permission Boundaries provides a robust multi-layered defense strategy. This setup ensures that even if an administrator mistakenly grants broad permissions, the guardrails remain in effect, effectively preventing accidental or malicious privilege escalation across the entire AWS organization.

Answer

Assign IAM policies directly to the root user of every member account.

Answer

Configure individual IAM users in every account to ensure fine-grained control.

Answer

Enable AWS CloudTrail only in the primary management account.

Question 13

Which IAM configuration helps prevent the 'confused deputy' problem when accessing cross-account resources?

Accepted Answer

External ID.. The 'External ID' is specifically designed to mitigate the confused deputy problem. When a third party assumes a role in your account, they must provide a unique identifier that you have pre-shared with them. This ensures that the third party is acting on behalf of the correct customer, preventing an attacker from tricking the service into accessing the wrong account's resources. It is a critical security control for cross-account integrations.

Answer

MFA requirement on the role.

Answer

Role session name.

Answer

Source IP condition.

Question 14

Which THREE actions are best practices for managing root user account security? (Select THREE)

Accepted Answer

Enable multi-factor authentication (MFA) on the root account.. The root user has unrestricted access to all resources. Therefore, it must be protected with the highest level of security. Enabling MFA, deleting access keys, and avoiding day-to-day tasks are essential. These actions minimize the risk of a full account takeover. By following these, you ensure that the root account is reserved for critical tasks like closing the account or managing specific billing configurations that cannot be delegated through IAM.

Answer

Store the root access keys in a secure, encrypted S3 bucket.

Answer

Use the root account for daily administrative tasks to simplify management.

Question 15

An application running on EC2 needs to access DynamoDB tables. What is the most secure way to provide these permissions?

Accepted Answer

Assign an IAM role to the EC2 instance via an instance profile.. Assigning an IAM role to an EC2 instance is the secure, standard AWS approach. The instance profile automatically provides temporary credentials that the SDK uses, eliminating the need for manual key rotation or storage. This method follows the principle of least privilege by scoping access strictly to the necessary DynamoDB resources, preventing exposure of long-term credentials and simplifying maintenance for the application developers and security administrators.

Answer

Embed IAM access keys directly into the application code.

Answer

Store IAM access keys in a configuration file on the EC2 instance.

Answer

Create a public DynamoDB table to allow unauthenticated access.

Question 16

A security engineer needs to prevent IAM users from disabling CloudTrail. Which policy element is most appropriate?

Accepted Answer

Use an SCP to explicitly deny 'cloudtrail:StopLogging' for the organization.. Using an explicit 'Deny' on the 'cloudtrail:StopLogging' action in a Service Control Policy (SCP) or a Permission Boundary is the most effective way to prevent even administrators from disabling logging. By applying this as a guardrail, you ensure that audit integrity is maintained regardless of individual user privileges. This is crucial for compliance, as it creates an immutable audit trail that security teams can rely on during incident investigations.

Answer

Create an IAM policy that denies 'cloudtrail:StopLogging' to all users.

Answer

Enable MFA Delete on all CloudTrail S3 buckets.

Answer

Restrict access to the CloudTrail console via IAM groups.

Question 17

A developer in Account A needs to use an AWS KMS customer managed key (CMK) located in Account B to encrypt data. Which TWO configuration steps are necessary to allow this cross-account access?

Accepted Answer

The KMS key policy in Account B must grant the developer's IAM ARN in Account A permission to use the key.. Accessing a KMS key in a different account requires coordination between the IAM policy in the calling account and the key policy in the owning account. KMS is unique because the key policy must explicitly allow the use of the key even if an IAM policy provides permission. This double-check mechanism ensures that key owners maintain strict control over who can decrypt data.

Answer

The developer must assume a role in Account B that has permissions to the KMS key.

Answer

The KMS key in Account B must be converted to a multi-Region key to be accessible from Account A.

Answer

An IAM Peering Connection must be established between Account A and Account B.

Question 18

A company wants to identify any S3 buckets or IAM roles in their AWS account that are accessible by external AWS accounts or public users. Which AWS service provides this functionality by analyzing resource-based policies?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. This includes S3 buckets, IAM roles, and KMS keys. By analyzing resource-based policies, it provides findings that allow security engineers to verify if the access is intended, helping to prevent accidental data exposure or unauthorized cross-account access.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 19

A security engineer needs to identify and protect Personally Identifiable Information (PII) stored in thousands of S3 buckets across multiple AWS accounts. The solution must provide a centralized dashboard and use machine learning to classify data. Which service is best suited for this task?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically provides an inventory of S3 buckets and can be configured to scan objects for PII, providing a centralized view of data risks.

Answer

Amazon GuardDuty

Answer

AWS Glue DataBrew

Answer

AWS Security Hub

Question 20

An auditor needs to verify which IAM policies are attached to a specific user. Which command provides this information?

Accepted Answer

aws iam list-attached-user-policies --user-name <username>. The AWS CLI is the primary tool for querying IAM metadata. The 'list-attached-user-policies' command specifically returns a list of all managed policies attached to the specified user. This is critical for security audits, where verifying the effective permissions of a principal is essential to ensure they match the requirements of their role and that no excessive privileges have been granted accidentally over time.

Answer

aws iam list-user-policies --user-name <username>

Answer

aws iam get-user-policy --user-name <username>

Answer

aws iam describe-user --user-name <username>