SCS-C03 Practice Test 4 — 25 Questions

Question 1

A security engineer must ensure that all EBS volumes in an account are encrypted by default. How should they achieve this?

Accepted Answer

Enable 'EBS encryption' in the EC2 console settings.. Enabling 'EBS encryption by default' in the EC2 console settings is the correct action. The option text should be updated to match the exact feature name for clarity.

Answer

Create an IAM policy that denies ec2:CreateVolume.

Answer

Apply a resource tag to all existing volumes.

Answer

Use AWS Trusted Advisor to delete unencrypted volumes.

Question 2

A company requires that all cloud resources be tagged with a 'Department' code for cost allocation and security reporting. How should they enforce this?

Accepted Answer

Use AWS Config rules to monitor tagging compliance.. AWS Config is the primary tool for auditing and ensuring resource compliance. By defining a custom or managed Config rule that checks for the existence of the 'Department' tag on resources, the organization can receive alerts when non-compliant resources are created. This ensures visibility into the state of the infrastructure and allows for timely remediation of tagging errors, supporting both financial governance and security-focused asset management.

Answer

Use AWS Budgets to force tagging.

Answer

Use an IAM policy to prevent resource creation.

Answer

Use AWS Trusted Advisor to tag resources.

Question 3

Which AWS IAM best practice ensures that users have only the permissions necessary to perform their specific business roles?

Accepted Answer

Apply the Principle of Least Privilege.. The 'Principle of Least Privilege' is the foundational concept in security governance. By ensuring that identities are granted the minimum level of access required to complete their tasks, organizations significantly reduce the blast radius if an account is compromised. This strategy prevents lateral movement and unauthorized data access, creating a much more resilient environment where security controls are proportional to the user's operational needs.

Answer

Assign the 'AdministratorAccess' policy to all users.

Answer

Use only root account credentials for all tasks.

Answer

Allow all traffic in Security Groups.

Question 4

Which THREE of the following are true regarding the AWS Shared Responsibility Model?

Accepted Answer

AWS is responsible for patching the underlying host operating system.. AWS is responsible for the security OF the cloud (hardware, global infrastructure, and the virtualization layer). Customers are responsible for security IN the cloud, which includes guest operating system patching, IAM policy configuration, data encryption, and network traffic protection (Security Groups/NACLs).

Answer

AWS is responsible for configuring the customer's IAM policies.

Answer

Customers are responsible for physical security of AWS data centers.

Question 5

A company is preparing for an annual regulatory audit and needs to collect evidence of their compliance with the SOC 2 framework across multiple AWS accounts. Which TWO AWS services or features should the security team use to automate the collection of evidence and download official compliance reports?

Accepted Answer

AWS Artifact. AWS Audit Manager and AWS Artifact are the primary services for governance and compliance evidence management. Audit Manager automates the process of gathering evidence from various AWS services to assess compliance with frameworks. AWS Artifact provides a central repository for on-demand access to AWS’s own security and compliance reports, which are essential for satisfying external auditors' requirements.

Answer

AWS Security Hub

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 6

Refer to the exhibit. A developer created this policy to troubleshoot S3 issues. Why is this a major security governance violation?

Accepted Answer

It violates the principle of least privilege.. The explanation correctly identifies that the use of 's3:*' on 'Resource: *' violates the principle of least privilege. The reasoning is sound and aligns with AWS security best practices.

Answer

It lacks a condition block for MFA.

Answer

It requires the 'Action' to be in a list format.

Answer

It does not specify a Region.

Question 7

A security engineer must ensure that no developer in a specific AWS Organizations member account can delete Amazon S3 buckets, even if they have AdministratorAccess. Which governance mechanism provides the most efficient and centralized way to enforce this restriction across the organizational unit?

Accepted Answer

Attach a Service Control Policy (SCP) to the Organizational Unit with a Deny statement for s3:DeleteBucket.. Service Control Policies (SCPs) function as a central guardrail within AWS Organizations, defining the maximum available permissions for accounts. They do not grant permissions but rather filter what can be granted by IAM policies. Mastering SCPs is critical for governance because they ensure that even administrative users cannot bypass organizational security mandates, providing a secondary layer of defense against unauthorized resource deletion across the entire environment.

Answer

Apply a resource-based policy to every S3 bucket that denies the s3:DeleteBucket action.

Answer

Create an IAM Permission Boundary and apply it to every IAM user and role within the member account.

Answer

Configure AWS Config rules to automatically remediate and recreate any deleted S3 buckets.

Question 8

According to the AWS Shared Responsibility Model, which of the following security tasks is the sole responsibility of the customer when using Amazon EC2 instances?

Accepted Answer

Managing and patching the guest operating system installed on the instance.. The Shared Responsibility Model distinguishes between security 'of' the cloud (AWS) and security 'in' the cloud (customer). For infrastructure services like EC2, AWS manages the physical hardware, virtualization layer, and facility security. The customer is responsible for everything from the operating system up, including patching the OS, managing firewall rules, and protecting their data.

Answer

Patching the underlying virtualization software on the physical host.

Answer

Maintaining the physical security of the data centers where instances reside.

Answer

Disposing of decommissioned physical storage drives in a secure manner.

Question 9

A company wants to implement a governance strategy that prevents any member account in the organization from disabling CloudTrail or deleting the organization-level trail. What is the most effective way to implement this while allowing account administrators to manage their own local resources?

Accepted Answer

Enable an organization trail in the management account and apply an SCP to deny CloudTrail modification in member accounts.. To maintain governance in a multi-account environment, organizational trails should be used. By creating the trail at the organization level, it is automatically deployed to all accounts. Combining this with a Service Control Policy (SCP) that denies 'cloudtrail:StopLogging' and 'cloudtrail:DeleteTrail' ensures that member accounts cannot tamper with the audit logs, providing immutable governance across the enterprise.

Answer

Create an IAM role in each member account that only the security team can assume to manage CloudTrail.

Answer

Enable AWS Config in all accounts and create a custom rule to restart CloudTrail if it is stopped.

Answer

Use AWS CloudFormation StackSets to deploy a local trail in each account with a strict resource-based policy.

Question 10

An organization wants to centralize the management of Amazon GuardDuty across 50 AWS accounts. They want the security team to be able to view and manage findings for all accounts from a single dashboard. What is the recommended governance approach?

Accepted Answer

Designate a security account as the GuardDuty delegated administrator through the AWS Organizations management account.. AWS Organizations allows for delegated administration of security services. By designating a security account as the GuardDuty delegated administrator, the organization centralizes finding management. This allows the security team to enable GuardDuty in member accounts, view all findings, and manage suppression rules from one place, ensuring consistent threat detection governance across the entire enterprise.

Answer

Use an AWS CloudFormation StackSet to enable GuardDuty and an SNS topic in every account.

Answer

Manually send invitations from the security account to each of the 49 member accounts to link them.

Answer

Configure an Amazon S3 bucket in each account to store findings and use Athena for centralized querying.

Question 11

A company wants to implement a robust governance framework for their AWS accounts using AWS Control Tower. They need to ensure that specific security guardrails are applied to their 'Financial-Apps' Organizational Unit (OU). Which TWO types of guardrails can be applied within Control Tower?

Accepted Answer

Preventive guardrails using Service Control Policies (SCPs).. AWS Control Tower provides two types of guardrails: preventive and detective. Preventive guardrails are implemented using Service Control Policies (SCPs) to block unauthorized actions. Detective guardrails are implemented using AWS Config rules to monitor and alert on non-compliant resource configurations. Together, they provide a comprehensive governance layer for managing account compliance and security.

Answer

Reactive guardrails using AWS Systems Manager Automation documents.

Answer

Proactive guardrails using IAM Permission Boundaries.

Answer

Administrative guardrails using AWS IAM Identity Center (Succeeded AWS SSO).

Question 12

A security engineer needs to verify if all AWS accounts in the organization are compliant with the CIS AWS Foundations Benchmark. Which service provides a centralized compliance dashboard and the ability to run automated checks against this specific benchmark?

Accepted Answer

AWS Security Hub. AWS Security Hub is designed for security posture management and governance. It includes built-in security standards, such as the CIS AWS Foundations Benchmark, which consist of automated checks. By enabling Security Hub across an organization, the security team gains a centralized view of compliance scores and specific failing resources across all member accounts.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Artifact

Question 13

A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?

Accepted Answer

Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.. Implementing a multi-layered defense strategy is essential for detecting and mitigating brute-force attacks. By combining network-level blocking through WAF and host-level monitoring via CloudWatch, organizations can ensure that anomalous patterns are detected in real-time. This proactive detection allows for automated responses, such as modifying security group rules, which significantly reduces the window of opportunity for attackers to successfully compromise sensitive workloads and accounts.

Answer

Use AWS Shield Standard to mitigate Layer 7 application attacks.

Answer

Enable AWS Trusted Advisor to monitor for open security groups.

Answer

Implement AWS Inspector to scan for vulnerabilities on the instances.

Question 14

A company wants to aggregate security findings from AWS GuardDuty, AWS Inspector, and AWS Macie into a single dashboard for prioritized viewing. Which service should be used to provide this consolidated view of security alerts?

Accepted Answer

AWS Security Hub. AWS Security Hub is the primary service for aggregating, organizing, and prioritizing security findings from multiple AWS services. It provides a comprehensive view of the security state of an AWS environment by collecting data from GuardDuty, Inspector, Macie, and third-party products, facilitating a more effective incident response and compliance monitoring process.

Answer

Amazon CloudWatch ServiceLens

Answer

AWS Trusted Advisor

Answer

AWS Config Aggregator

Question 15

Which TWO actions should be taken to ensure that Amazon GuardDuty has the necessary data to detect unauthorized cryptocurrency mining instances?

Accepted Answer

Enable VPC Flow Logs in all regions.. GuardDuty relies on both VPC Flow Logs and DNS logs to identify crypto-mining patterns. Flow logs enable the detection of connections to known mining pool endpoints, while DNS logs reveal attempts to resolve these malicious domain names. Providing these inputs ensures GuardDuty's machine learning models can accurately correlate network activity with known bad actors, which is vital for maintaining the performance and integrity of the compute infrastructure against resource hijacking.

Answer

Configure CloudWatch Logs with metric filters.

Answer

Install the CloudWatch agent on all instances.

Answer

Create an IAM role for GuardDuty to access S3.

Question 16

An organization is running critical workloads on Amazon EKS and wants to detect suspicious activity at the container runtime level, such as unauthorized process execution or unexpected file access. Which GuardDuty feature should be enabled to achieve this level of visibility?

Accepted Answer

GuardDuty Runtime Monitoring. GuardDuty Runtime Monitoring for EKS provides deep visibility into container-level activities. It uses a lightweight agent (GuardDuty security agent) deployed as a DaemonSet to monitor system calls and process execution. This allows GuardDuty to detect threats that occur within the container itself, which standard VPC Flow Logs or CloudTrail cannot see.

Answer

GuardDuty EKS Audit Log Monitoring

Answer

Amazon Inspector Container Scanning

Answer

VPC Traffic Mirroring for EKS Worker Nodes

Question 17

Refer to the exhibit. This GuardDuty finding indicates that malware was detected on an EC2 instance. What is the process GuardDuty used to perform this scan without installing an agent on the instance?

Accepted Answer

It takes a snapshot of the EBS volume, restores it to a service-owned account, and scans the volume there.. GuardDuty Malware Protection performs agentless scans of EBS volumes. When a suspicious finding is triggered (like a command-and-control communication), GuardDuty creates a snapshot of the EBS volumes, shares them with a service-linked account, and then attaches them to a scanning instance to perform a malware analysis.

Answer

It uses the AWS Systems Manager (SSM) Agent to run a remote anti-virus script on the instance.

Answer

It performs deep packet inspection (DPI) on the VPC traffic to identify malware being downloaded.

Answer

It uses the GuardDuty Security Agent to perform a memory dump and analyze it for malicious strings.

Question 18

A company wants to detect when an IAM user executes a command from a suspicious IP address. Which tool can analyze historical CloudTrail data to establish a baseline of normal behavior and trigger alerts upon deviations?

Accepted Answer

Amazon GuardDuty.. Amazon GuardDuty provides automated anomaly detection based on CloudTrail, VPC Flow Logs, and DNS logs. It uses machine learning to profile typical user behavior and detects deviations such as logins from unusual locations or IP addresses associated with known malicious actors. This is crucial for environments where manual rule creation is impossible due to the sheer volume of users, as it identifies threats without requiring static IP allow-lists.

Answer

CloudWatch Contributor Insights.

Answer

AWS CloudTrail Insights.

Answer

AWS Config.

Question 19

A company is designing a hub-and-spoke network architecture using AWS Transit Gateway. They want to centralize inbound and outbound internet traffic inspection using a fleet of firewalls in a dedicated 'Security VPC'. Which TWO steps are required to ensure traffic is correctly routed for inspection? (Select TWO.)

Accepted Answer

Enable 'Appliance Mode' on the Transit Gateway VPC attachment for the Security VPC.. In a centralized inspection model, Transit Gateway (TGW) acts as the hub. Traffic from spoke VPCs must be routed to the TGW, which then uses a specific route table to forward traffic to the Security VPC. Appliance Mode must be enabled on the TGW attachment to ensure session stickiness for stateful firewalls.

Answer

Disable 'Source/Destination Check' on all Transit Gateway attachments.

Answer

Use VPC Peering between all spoke VPCs and the Security VPC to bypass the Transit Gateway.

Answer

Create a separate NAT Gateway in every spoke VPC to handle the inspection traffic locally.

Question 20

A security engineer wants to enable manual remediation of Security Hub findings directly from the AWS console. They want to be able to select a finding and trigger a specific Lambda function to isolate an instance. What is the correct way to configure this?

Accepted Answer

Create a Security Hub Custom Action and an EventBridge rule that triggers the Lambda function based on the Action ID.. Security Hub Custom Actions allow users to create custom response and remediation workflows. When a custom action is triggered by a user in the console, Security Hub sends the selected finding(s) to Amazon EventBridge. An EventBridge rule then matches the custom action ARN and triggers the associated Lambda function.

Answer

Use the Security Hub 'Auto-Remediate' feature to link a finding type directly to a Lambda function.

Answer

Configure a CloudWatch Alarm to monitor Security Hub findings and trigger an SNS topic for remediation.

Answer

Enable the 'Remediation' standard in Security Hub and select the 'Isolate EC2' managed rule.