SCS-C03 Practice Test 2 — 25 Questions

Question 1

A security incident indicates an EC2 instance is likely compromised and communicating with a C2 server. The security team needs to perform memory forensics and isolate the instance while preserving evidence. Which TWO actions should the team perform?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Snapshot the EBS volumes attached to the instance.. In an incident response scenario, capturing the volatile state of an instance is vital before isolation or termination occurs. Snapshotting the EBS volume allows for offline disk forensics, while memory dumps capture active threats that do not persist on disk. These actions follow standard digital forensics procedures to ensure evidence integrity, enabling a thorough investigation into the root cause of the compromise without losing critical data residing only in RAM.

Answer

Terminate the EC2 instance immediately to stop the data exfiltration.

Answer

Attach a new IAM role with administrative privileges to the instance.

Answer

Remove the VPC flow logs to save storage costs during the investigation.

Question 2

A company needs to log all DNS queries made by EC2 instances within their VPC to identify potential data exfiltration via DNS tunneling. Which feature should the security engineer enable?

Accepted Answer

Route 53 Resolver Query Logging.. Route 53 Resolver Query Logging allows you to log all DNS queries made by resources within your VPC. This includes queries for public domain names, internal VPC domain names, and even queries made via Route 53 Resolver DNS Firewall, providing the visibility needed to detect anomalies like DNS tunneling.

Answer

VPC Flow Logs for all subnets.

Answer

CloudTrail management events.

Answer

Amazon GuardDuty DNS Security.

Question 3

Refer to the exhibit. An IAM user with the 'Finance' tag is trying to upload an object to the 'production-data' bucket. The upload is failing. What is the most likely cause?

Accepted Answer

The user does not have the 'Department' tag attached to their IAM principal.. The policy uses a Deny effect with a StringNotEquals condition. If the principal tag 'Department' is anything other than 'Finance', the action is denied. However, if the user's tag is missing or the principal does not have the expected tag during the request, the condition evaluates to true, triggering the Deny. This exhibit highlights how attribute-based access control (ABAC) relies heavily on accurate, consistent tagging across all principal entities.

Answer

The user is missing the required S3 permission in their IAM policy.

Answer

The S3 bucket policy is not allowing the action.

Answer

The S3 bucket is in a different AWS region.

Question 4

A security engineer must protect a multi-tier web application hosted in Amazon EC2 instances inside a private subnet. The application requires outbound internet access to download software updates, but malicious actors must never be able to initiate inbound connections to the instances. Which architecture satisfies these requirements securely?

Accepted Answer

Provision a NAT Gateway in a public subnet, and configure the private subnet route table to direct 0.0.0.0/0 traffic to that NAT Gateway.. Routing outbound traffic through a NAT Gateway ensures that instances can initiate communication with external endpoints while remaining entirely unreachable from the outside. NAT Gateways do not support inbound traffic initiation, providing a robust boundary. This design prevents direct exposure of private workloads, aligning with defense-in-depth principles for infrastructure security in AWS environments.

Answer

Attach an Elastic IP directly to each EC2 instance and remove the default route pointing to the internet gateway in the route table.

Answer

Deploy an Internet Gateway in the private subnet and associate it with the route table used by the application instances.

Answer

Configure a VPC endpoint for every external repository and remove all internet route entries from the VPC route tables entirely.

Question 5

Refer to the exhibit. A security engineer notices that despite the IP restriction, users are still unable to access the S3 bucket from within the corporate network. What is the most likely cause of this issue?

Accepted Answer

The 'Action' element is missing from the policy, causing it to be invalid.. The policy exhibit is incomplete because it lacks the 'Action' field, which is mandatory in AWS IAM and bucket policies. Without defining the action, the policy is syntactically invalid and will result in an 'Access Denied' error. Ensuring policy syntax is correct is a fundamental step in infrastructure security to prevent accidental service outages caused by misconfigured permissions or invalid JSON structures in resource-based policies.

Answer

The VPC endpoint for S3 is not configured to allow the corporate IP range.

Answer

The 'aws:SourceIp' condition key is not supported for Amazon S3 bucket policies.

Answer

The S3 bucket does not have the 'Block Public Access' feature disabled.

Question 6

A security engineer needs to ensure that all EC2 instances are patched against critical vulnerabilities without exposing them to the public internet. Which architecture is most appropriate for this task?

Accepted Answer

Use Systems Manager with VPC endpoints to manage instances in a private subnet.. Using a combination of AWS Systems Manager (SSM) and a VPC endpoint for SSM enables management of instances in private subnets without an Internet Gateway or NAT Gateway. This setup allows the SSM agent to communicate with the AWS Systems Manager service securely over the internal AWS network. This is the optimal infrastructure security design for maintaining patching compliance while adhering to strict network isolation requirements.

Answer

Deploy a NAT Gateway in a public subnet to allow outbound traffic for patching.

Answer

Enable public IP addresses on instances and use Security Groups to restrict outbound traffic.

Answer

Manually download patches to an S3 bucket and have instances pull them locally.

Question 7

An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)

Accepted Answer

Apply SCPs at the root level to restrict specific AWS services in member accounts.. Implementing AWS Organizations allows for centralized management and governance. Service Control Policies (SCPs) act as guardrails, defining the maximum permissions allowed within an account, regardless of user identity. Combining SCPs with IAM Permission Boundaries provides a robust multi-layered defense strategy. This setup ensures that even if an administrator mistakenly grants broad permissions, the guardrails remain in effect, effectively preventing accidental or malicious privilege escalation across the entire AWS organization.

Answer

Assign IAM policies directly to the root user of every member account.

Answer

Configure individual IAM users in every account to ensure fine-grained control.

Answer

Enable AWS CloudTrail only in the primary management account.

Question 8

Which IAM configuration helps prevent the 'confused deputy' problem when accessing cross-account resources?

Accepted Answer

External ID.. The 'External ID' is specifically designed to mitigate the confused deputy problem. When a third party assumes a role in your account, they must provide a unique identifier that you have pre-shared with them. This ensures that the third party is acting on behalf of the correct customer, preventing an attacker from tricking the service into accessing the wrong account's resources. It is a critical security control for cross-account integrations.

Answer

MFA requirement on the role.

Answer

Role session name.

Answer

Source IP condition.

Question 9

Which THREE actions are best practices for managing root user account security? (Select THREE)

Accepted Answer

Enable multi-factor authentication (MFA) on the root account.. The root user has unrestricted access to all resources. Therefore, it must be protected with the highest level of security. Enabling MFA, deleting access keys, and avoiding day-to-day tasks are essential. These actions minimize the risk of a full account takeover. By following these, you ensure that the root account is reserved for critical tasks like closing the account or managing specific billing configurations that cannot be delegated through IAM.

Answer

Store the root access keys in a secure, encrypted S3 bucket.

Answer

Use the root account for daily administrative tasks to simplify management.

Question 10

An application running on EC2 needs to access DynamoDB tables. What is the most secure way to provide these permissions?

Accepted Answer

Assign an IAM role to the EC2 instance via an instance profile.. Assigning an IAM role to an EC2 instance is the secure, standard AWS approach. The instance profile automatically provides temporary credentials that the SDK uses, eliminating the need for manual key rotation or storage. This method follows the principle of least privilege by scoping access strictly to the necessary DynamoDB resources, preventing exposure of long-term credentials and simplifying maintenance for the application developers and security administrators.

Answer

Embed IAM access keys directly into the application code.

Answer

Store IAM access keys in a configuration file on the EC2 instance.

Answer

Create a public DynamoDB table to allow unauthenticated access.

Question 11

A security engineer needs to prevent IAM users from disabling CloudTrail. Which policy element is most appropriate?

Accepted Answer

Use an SCP to explicitly deny 'cloudtrail:StopLogging' for the organization.. Using an explicit 'Deny' on the 'cloudtrail:StopLogging' action in a Service Control Policy (SCP) or a Permission Boundary is the most effective way to prevent even administrators from disabling logging. By applying this as a guardrail, you ensure that audit integrity is maintained regardless of individual user privileges. This is crucial for compliance, as it creates an immutable audit trail that security teams can rely on during incident investigations.

Answer

Create an IAM policy that denies 'cloudtrail:StopLogging' to all users.

Answer

Enable MFA Delete on all CloudTrail S3 buckets.

Answer

Restrict access to the CloudTrail console via IAM groups.

Question 12

A developer in Account A needs to use an AWS KMS customer managed key (CMK) located in Account B to encrypt data. Which TWO configuration steps are necessary to allow this cross-account access?

Accepted Answer

The KMS key policy in Account B must grant the developer's IAM ARN in Account A permission to use the key.. Accessing a KMS key in a different account requires coordination between the IAM policy in the calling account and the key policy in the owning account. KMS is unique because the key policy must explicitly allow the use of the key even if an IAM policy provides permission. This double-check mechanism ensures that key owners maintain strict control over who can decrypt data.

Answer

The developer must assume a role in Account B that has permissions to the KMS key.

Answer

The KMS key in Account B must be converted to a multi-Region key to be accessible from Account A.

Answer

An IAM Peering Connection must be established between Account A and Account B.

Question 13

A company wants to identify any S3 buckets or IAM roles in their AWS account that are accessible by external AWS accounts or public users. Which AWS service provides this functionality by analyzing resource-based policies?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. This includes S3 buckets, IAM roles, and KMS keys. By analyzing resource-based policies, it provides findings that allow security engineers to verify if the access is intended, helping to prevent accidental data exposure or unauthorized cross-account access.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 14

A security engineer needs to identify and protect Personally Identifiable Information (PII) stored in thousands of S3 buckets across multiple AWS accounts. The solution must provide a centralized dashboard and use machine learning to classify data. Which service is best suited for this task?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically provides an inventory of S3 buckets and can be configured to scan objects for PII, providing a centralized view of data risks.

Answer

Amazon GuardDuty

Answer

AWS Glue DataBrew

Answer

AWS Security Hub

Question 15

An auditor needs to verify which IAM policies are attached to a specific user. Which command provides this information?

Accepted Answer

aws iam list-attached-user-policies --user-name <username>. The AWS CLI is the primary tool for querying IAM metadata. The 'list-attached-user-policies' command specifically returns a list of all managed policies attached to the specified user. This is critical for security audits, where verifying the effective permissions of a principal is essential to ensure they match the requirements of their role and that no excessive privileges have been granted accidentally over time.

Answer

aws iam list-user-policies --user-name <username>

Answer

aws iam get-user-policy --user-name <username>

Answer

aws iam describe-user --user-name <username>

Question 16

A company is using AWS IAM Identity Center (successor to AWS Single Sign-On) to manage access to their AWS accounts. They want to automate the process of adding and removing users based on their status in an external identity provider. Which protocol should they use?

Accepted Answer

SCIM (System for Cross-domain Identity Management). AWS IAM Identity Center is the recommended service for managing single sign-on access to AWS accounts and business applications. It provides a centralized place to manage user identities and their access levels. For organizations with existing directories like Active Directory, Identity Center simplifies the process of provisioning users and mapping them to specific permission sets across the entire AWS Organization.

Answer

SAML 2.0 (Security Assertion Markup Language)

Answer

LDAP (Lightweight Directory Access Protocol)

Answer

OpenID Connect (OIDC)

Question 17

A company is setting up SAML 2.0 federation to allow employees to log into the AWS Management Console using their corporate credentials. Which TWO components are required to establish this trust relationship in AWS?

Accepted Answer

An IAM SAML Identity Provider entity created in the AWS account.. SAML 2.0 federation allows users to use their existing corporate credentials to access the AWS Management Console. This centralizes identity management and reduces the need for multiple sets of credentials. Configuring the trust relationship involves exchanging metadata between the Identity Provider and AWS, ensuring that the assertion contains the necessary attributes for role mapping and session management.

Answer

An IAM User with programmatic access keys for the Identity Provider.

Answer

A CloudFront distribution to cache the SAML assertion responses.

Answer

An Amazon Cognito User Pool to store the federated user profiles.

Question 18

A large enterprise wants to implement SAML 2.0-based federation to allow employees to access the AWS Management Console using their existing corporate credentials. Which TWO steps are required to establish this trust relationship and enable user access?

Accepted Answer

Create an IAM SAML identity provider in the AWS account using the metadata document provided by the corporate IdP.. Establishing SAML federation requires a mutual trust between the Identity Provider (IdP) and AWS. This involves exchanging metadata and mapping SAML attributes to AWS IAM roles. These steps ensure that AWS can verify the identity of the incoming user and assign them the correct permissions based on their corporate group membership.

Answer

Install the AWS CLI on each employee's local machine and configure it with their corporate username and password.

Answer

Enable Multi-Factor Authentication (MFA) on the AWS root user to allow SAML assertions to be processed securely.

Answer

Create individual IAM users for every employee and map them to their corresponding corporate identities using tags.

Question 19

A company is migrating a legacy database to Amazon RDS for MySQL and must ensure the data is protected according to strict compliance standards. The security team requires that the data at rest is encrypted and that the encryption cannot be disabled after the instance is created. Which TWO statements accurately describe RDS encryption behavior?

Accepted Answer

Snapshots and automated backups of an encrypted RDS instance are automatically encrypted using the same KMS key.. Amazon RDS encryption at rest is a foundational security feature that must be decided at the time of resource creation. It uses the AES-256 encryption algorithm to protect data stored on the underlying volumes, as well as backups and snapshots. Understanding the lifecycle of encrypted instances is critical for maintaining a secure data environment.

Answer

Encryption at rest can be enabled for an existing unencrypted RDS DB instance by modifying the instance settings.

Answer

Encryption at rest can be disabled on an RDS instance to improve performance during large data imports.

Answer

RDS encryption at rest only protects the database tables and does not apply to logs or temporary files.

Question 20

Refer to the exhibit. This S3 bucket policy is applied to a bucket named 'marketing-data'. What is the effect of this policy regarding access to the objects in the bucket?

Accepted Answer

It allows any IAM user or role within any account belonging to the AWS Organization 'o-1234567890' to read objects.. The PrincipalOrgID condition key is a powerful tool for restricting resource access to identities within a specific AWS Organization. This allows for broad 'Allow' statements that are still safely scoped to internal users only. Mastering this condition helps in creating scalable resource-based policies that don't require listing individual account IDs, thus reducing complexity and manual errors.

Answer

It makes the bucket public to anyone on the internet as long as they are using an AWS account.

Answer

It allows access only if the S3 bucket itself is owned by the organization 'o-1234567890'.

Answer

It requires that the request must originate from a VPC endpoint that is tagged with the organization ID.