SCS-C03 Practice Exam 4 — 20 Questions

Question 1

Refer to the exhibit. A developer is attempting to upload an object to 'my-secure-bucket' using the AWS CLI but receives an 'Access Denied' error. The developer's command was: 'aws s3 cp file.txt s3://my-secure-bucket/file.txt'. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The developer failed to include the '--sse aws:kms' parameter in the CLI command, violating the bucket policy condition.. The bucket policy explicitly denies any s3:PutObject request that does not include the SSE-KMS encryption header. The CLI command used by the developer did not specify an encryption method, causing the request to lack the required 's3:x-amz-server-side-encryption' header, which triggered the 'Deny' effect in the bucket policy.

Answer

The developer does not have the kms:GenerateDataKey permission for the default KMS key used by the bucket.

Answer

The bucket policy is missing a 'Sid' (Statement ID) which makes the policy invalid and causes S3 to default to a 'Deny' for all requests.

Answer

The 'Resource' ARN in the policy is incorrectly formatted because it uses a wildcard, which is not allowed for s3:PutObject actions.

Question 2

An organization is using Amazon Macie to protect sensitive data in S3. They want to ensure they are alerted to the presence of PII across all buckets. Which TWO actions are required to configure Macie to identify sensitive data effectively?

Accepted Answer

Create a sensitive data discovery job to scan the S3 buckets, specifying the depth and frequency of the analysis.. Amazon Macie requires both a discovery job and the proper permissions to analyze data. Discovery jobs allow you to define the scope and frequency of the scan, while the service-linked role ensures Macie has the necessary access to read the objects in your S3 buckets for analysis and classification.

Answer

Install the Macie agent on all EC2 instances that write data to the S3 buckets to classify data in real-time.

Answer

Configure S3 Event Notifications to send every new object to a Lambda function that calls the Macie 'ScanObject' API.

Answer

Enable S3 Object Lock on all buckets to allow Macie to generate findings without the risk of data being deleted during a scan.

Question 3

A company requires that all cloud resources be tagged with a 'Department' code for cost allocation and security reporting. How should they enforce this?

Accepted Answer

Use AWS Config rules to monitor tagging compliance.. AWS Config is the primary tool for auditing and ensuring resource compliance. By defining a custom or managed Config rule that checks for the existence of the 'Department' tag on resources, the organization can receive alerts when non-compliant resources are created. This ensures visibility into the state of the infrastructure and allows for timely remediation of tagging errors, supporting both financial governance and security-focused asset management.

Answer

Use AWS Budgets to force tagging.

Answer

Use an IAM policy to prevent resource creation.

Answer

Use AWS Trusted Advisor to tag resources.

Question 4

Which AWS IAM best practice ensures that users have only the permissions necessary to perform their specific business roles?

Accepted Answer

Apply the Principle of Least Privilege.. The 'Principle of Least Privilege' is the foundational concept in security governance. By ensuring that identities are granted the minimum level of access required to complete their tasks, organizations significantly reduce the blast radius if an account is compromised. This strategy prevents lateral movement and unauthorized data access, creating a much more resilient environment where security controls are proportional to the user's operational needs.

Answer

Assign the 'AdministratorAccess' policy to all users.

Answer

Use only root account credentials for all tasks.

Answer

Allow all traffic in Security Groups.

Question 5

A company is preparing for an annual regulatory audit and needs to collect evidence of their compliance with the SOC 2 framework across multiple AWS accounts. Which TWO AWS services or features should the security team use to automate the collection of evidence and download official compliance reports?

Accepted Answer

AWS Artifact. AWS Audit Manager and AWS Artifact are the primary services for governance and compliance evidence management. Audit Manager automates the process of gathering evidence from various AWS services to assess compliance with frameworks. AWS Artifact provides a central repository for on-demand access to AWS’s own security and compliance reports, which are essential for satisfying external auditors' requirements.

Answer

AWS Security Hub

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 6

A security engineer must ensure that no developer in a specific AWS Organizations member account can delete Amazon S3 buckets, even if they have AdministratorAccess. Which governance mechanism provides the most efficient and centralized way to enforce this restriction across the organizational unit?

Accepted Answer

Attach a Service Control Policy (SCP) to the Organizational Unit with a Deny statement for s3:DeleteBucket.. Service Control Policies (SCPs) function as a central guardrail within AWS Organizations, defining the maximum available permissions for accounts. They do not grant permissions but rather filter what can be granted by IAM policies. Mastering SCPs is critical for governance because they ensure that even administrative users cannot bypass organizational security mandates, providing a secondary layer of defense against unauthorized resource deletion across the entire environment.

Answer

Apply a resource-based policy to every S3 bucket that denies the s3:DeleteBucket action.

Answer

Create an IAM Permission Boundary and apply it to every IAM user and role within the member account.

Answer

Configure AWS Config rules to automatically remediate and recreate any deleted S3 buckets.

Question 7

According to the AWS Shared Responsibility Model, which of the following security tasks is the sole responsibility of the customer when using Amazon EC2 instances?

Accepted Answer

Managing and patching the guest operating system installed on the instance.. The Shared Responsibility Model distinguishes between security 'of' the cloud (AWS) and security 'in' the cloud (customer). For infrastructure services like EC2, AWS manages the physical hardware, virtualization layer, and facility security. The customer is responsible for everything from the operating system up, including patching the OS, managing firewall rules, and protecting their data.

Answer

Patching the underlying virtualization software on the physical host.

Answer

Maintaining the physical security of the data centers where instances reside.

Answer

Disposing of decommissioned physical storage drives in a secure manner.

Question 8

A company wants to implement a governance strategy that prevents any member account in the organization from disabling CloudTrail or deleting the organization-level trail. What is the most effective way to implement this while allowing account administrators to manage their own local resources?

Accepted Answer

Enable an organization trail in the management account and apply an SCP to deny CloudTrail modification in member accounts.. To maintain governance in a multi-account environment, organizational trails should be used. By creating the trail at the organization level, it is automatically deployed to all accounts. Combining this with a Service Control Policy (SCP) that denies 'cloudtrail:StopLogging' and 'cloudtrail:DeleteTrail' ensures that member accounts cannot tamper with the audit logs, providing immutable governance across the enterprise.

Answer

Create an IAM role in each member account that only the security team can assume to manage CloudTrail.

Answer

Enable AWS Config in all accounts and create a custom rule to restart CloudTrail if it is stopped.

Answer

Use AWS CloudFormation StackSets to deploy a local trail in each account with a strict resource-based policy.

Question 9

An organization wants to centralize the management of Amazon GuardDuty across 50 AWS accounts. They want the security team to be able to view and manage findings for all accounts from a single dashboard. What is the recommended governance approach?

Accepted Answer

Designate a security account as the GuardDuty delegated administrator through the AWS Organizations management account.. AWS Organizations allows for delegated administration of security services. By designating a security account as the GuardDuty delegated administrator, the organization centralizes finding management. This allows the security team to enable GuardDuty in member accounts, view all findings, and manage suppression rules from one place, ensuring consistent threat detection governance across the entire enterprise.

Answer

Use an AWS CloudFormation StackSet to enable GuardDuty and an SNS topic in every account.

Answer

Manually send invitations from the security account to each of the 49 member accounts to link them.

Answer

Configure an Amazon S3 bucket in each account to store findings and use Athena for centralized querying.

Question 10

A company wants to implement a robust governance framework for their AWS accounts using AWS Control Tower. They need to ensure that specific security guardrails are applied to their 'Financial-Apps' Organizational Unit (OU). Which TWO types of guardrails can be applied within Control Tower?

Accepted Answer

Preventive guardrails using Service Control Policies (SCPs).. AWS Control Tower provides two types of guardrails: preventive and detective. Preventive guardrails are implemented using Service Control Policies (SCPs) to block unauthorized actions. Detective guardrails are implemented using AWS Config rules to monitor and alert on non-compliant resource configurations. Together, they provide a comprehensive governance layer for managing account compliance and security.

Answer

Reactive guardrails using AWS Systems Manager Automation documents.

Answer

Proactive guardrails using IAM Permission Boundaries.

Answer

Administrative guardrails using AWS IAM Identity Center (Succeeded AWS SSO).

Question 11

A security engineer needs to verify if all AWS accounts in the organization are compliant with the CIS AWS Foundations Benchmark. Which service provides a centralized compliance dashboard and the ability to run automated checks against this specific benchmark?

Accepted Answer

AWS Security Hub. AWS Security Hub is designed for security posture management and governance. It includes built-in security standards, such as the CIS AWS Foundations Benchmark, which consist of automated checks. By enabling Security Hub across an organization, the security team gains a centralized view of compliance scores and specific failing resources across all member accounts.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Artifact

Question 12

A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?

Accepted Answer

Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.. Implementing a multi-layered defense strategy is essential for detecting and mitigating brute-force attacks. By combining network-level blocking through WAF and host-level monitoring via CloudWatch, organizations can ensure that anomalous patterns are detected in real-time. This proactive detection allows for automated responses, such as modifying security group rules, which significantly reduces the window of opportunity for attackers to successfully compromise sensitive workloads and accounts.

Answer

Use AWS Shield Standard to mitigate Layer 7 application attacks.

Answer

Enable AWS Trusted Advisor to monitor for open security groups.

Answer

Implement AWS Inspector to scan for vulnerabilities on the instances.

Question 13

A company wants to aggregate security findings from AWS GuardDuty, AWS Inspector, and AWS Macie into a single dashboard for prioritized viewing. Which service should be used to provide this consolidated view of security alerts?

Accepted Answer

AWS Security Hub. AWS Security Hub is the primary service for aggregating, organizing, and prioritizing security findings from multiple AWS services. It provides a comprehensive view of the security state of an AWS environment by collecting data from GuardDuty, Inspector, Macie, and third-party products, facilitating a more effective incident response and compliance monitoring process.

Answer

Amazon CloudWatch ServiceLens

Answer

AWS Trusted Advisor

Answer

AWS Config Aggregator

Question 14

Which TWO actions should be taken to ensure that Amazon GuardDuty has the necessary data to detect unauthorized cryptocurrency mining instances?

Accepted Answer

Enable VPC Flow Logs in all regions.. GuardDuty relies on both VPC Flow Logs and DNS logs to identify crypto-mining patterns. Flow logs enable the detection of connections to known mining pool endpoints, while DNS logs reveal attempts to resolve these malicious domain names. Providing these inputs ensures GuardDuty's machine learning models can accurately correlate network activity with known bad actors, which is vital for maintaining the performance and integrity of the compute infrastructure against resource hijacking.

Answer

Configure CloudWatch Logs with metric filters.

Answer

Install the CloudWatch agent on all instances.

Answer

Create an IAM role for GuardDuty to access S3.

Question 15

An organization is running critical workloads on Amazon EKS and wants to detect suspicious activity at the container runtime level, such as unauthorized process execution or unexpected file access. Which GuardDuty feature should be enabled to achieve this level of visibility?

Accepted Answer

GuardDuty Runtime Monitoring. GuardDuty Runtime Monitoring for EKS provides deep visibility into container-level activities. It uses a lightweight agent (GuardDuty security agent) deployed as a DaemonSet to monitor system calls and process execution. This allows GuardDuty to detect threats that occur within the container itself, which standard VPC Flow Logs or CloudTrail cannot see.

Answer

GuardDuty EKS Audit Log Monitoring

Answer

Amazon Inspector Container Scanning

Answer

VPC Traffic Mirroring for EKS Worker Nodes

Question 16

Refer to the exhibit. This GuardDuty finding indicates that malware was detected on an EC2 instance. What is the process GuardDuty used to perform this scan without installing an agent on the instance?

Accepted Answer

It takes a snapshot of the EBS volume, restores it to a service-owned account, and scans the volume there.. GuardDuty Malware Protection performs agentless scans of EBS volumes. When a suspicious finding is triggered (like a command-and-control communication), GuardDuty creates a snapshot of the EBS volumes, shares them with a service-linked account, and then attaches them to a scanning instance to perform a malware analysis.

Answer

It uses the AWS Systems Manager (SSM) Agent to run a remote anti-virus script on the instance.

Answer

It performs deep packet inspection (DPI) on the VPC traffic to identify malware being downloaded.

Answer

It uses the GuardDuty Security Agent to perform a memory dump and analyze it for malicious strings.

Question 17

A company wants to detect when an IAM user executes a command from a suspicious IP address. Which tool can analyze historical CloudTrail data to establish a baseline of normal behavior and trigger alerts upon deviations?

Accepted Answer

Amazon GuardDuty.. Amazon GuardDuty provides automated anomaly detection based on CloudTrail, VPC Flow Logs, and DNS logs. It uses machine learning to profile typical user behavior and detects deviations such as logins from unusual locations or IP addresses associated with known malicious actors. This is crucial for environments where manual rule creation is impossible due to the sheer volume of users, as it identifies threats without requiring static IP allow-lists.

Answer

CloudWatch Contributor Insights.

Answer

AWS CloudTrail Insights.

Answer

AWS Config.

Question 18

A company is designing a hub-and-spoke network architecture using AWS Transit Gateway. They want to centralize inbound and outbound internet traffic inspection using a fleet of firewalls in a dedicated 'Security VPC'. Which TWO steps are required to ensure traffic is correctly routed for inspection? (Select TWO.)

Accepted Answer

Enable 'Appliance Mode' on the Transit Gateway VPC attachment for the Security VPC.. In a centralized inspection model, Transit Gateway (TGW) acts as the hub. Traffic from spoke VPCs must be routed to the TGW, which then uses a specific route table to forward traffic to the Security VPC. Appliance Mode must be enabled on the TGW attachment to ensure session stickiness for stateful firewalls.

Answer

Disable 'Source/Destination Check' on all Transit Gateway attachments.

Answer

Use VPC Peering between all spoke VPCs and the Security VPC to bypass the Transit Gateway.

Answer

Create a separate NAT Gateway in every spoke VPC to handle the inspection traffic locally.

Question 19

A security engineer wants to enable manual remediation of Security Hub findings directly from the AWS console. They want to be able to select a finding and trigger a specific Lambda function to isolate an instance. What is the correct way to configure this?

Accepted Answer

Create a Security Hub Custom Action and an EventBridge rule that triggers the Lambda function based on the Action ID.. Security Hub Custom Actions allow users to create custom response and remediation workflows. When a custom action is triggered by a user in the console, Security Hub sends the selected finding(s) to Amazon EventBridge. An EventBridge rule then matches the custom action ARN and triggers the associated Lambda function.

Answer

Use the Security Hub 'Auto-Remediate' feature to link a finding type directly to a Lambda function.

Answer

Configure a CloudWatch Alarm to monitor Security Hub findings and trigger an SNS topic for remediation.

Answer

Enable the 'Remediation' standard in Security Hub and select the 'Isolate EC2' managed rule.

Question 20

Refer to the exhibit. An incident responder observes that an attacker bypassed this S3 bucket policy and accessed objects from an IP address outside the 192.0.2.0/24 range. What is the most likely reason for this access?

Accepted Answer

The policy uses 'Allow' instead of 'Deny', allowing bypass by any identity with broad IAM permissions.. The bucket policy is a resource-based policy that only grants permissions; it does not explicitly deny access from other IP addresses. In AWS, if an IAM user or role has an identity-based policy allowing 's3:GetObject' on that bucket, the resource-based policy will not restrict them unless it contains an explicit Deny. This behavior highlights the importance of using explicit Deny statements when enforcing network-based access controls on sensitive resources.

Answer

The bucket policy must include a Principal element to restrict access to specific identities.

Answer

The S3 bucket is configured with a public access block that is too permissive.

Answer

The 'aws:SourceIp' condition does not function for requests made through an AWS service like CloudFront.