SCS-C03 Practice Test 5 — 25 Questions

Question 1

During a security incident involving suspected data exfiltration from an S3 bucket, which THREE sources provide the most relevant telemetry to determine what files were accessed?

Accepted Answer

CloudTrail Data Events. Determining S3 data access requires combining different logging layers. S3 Server Access Logs provide basic request data, while CloudTrail Data Events provide granular information about specific object-level API calls. VPC Flow Logs are essential if the access was routed through a VPC endpoint. Using these three sources allows the investigator to correlate network traffic with specific identity-based API requests, providing a comprehensive view of the exfiltration activity.

Answer

AWS WAF Logs

Answer

AWS Trusted Advisor reports

Question 2

Refer to the exhibit. A user is attempting to connect to a web server from the IP address 203.0.113.5 on port 80. Based on the provided Network ACL and Security Group configurations, what will be the result of this connection attempt?

Accepted Answer

The connection will be denied because the NACL Rule 100 is evaluated first.. Network ACLs (NACLs) are processed before Security Groups for inbound traffic entering a subnet. NACLs are stateless and process rules in numerical order. In this scenario, Rule 100 in the NACL explicitly denies traffic from the specific IP address, so the packet is dropped before it can be evaluated by the Security Group.

Answer

The connection will be allowed because the Security Group permits all traffic on port 80.

Answer

The connection will be allowed because NACL Rule 200 permits all traffic on port 80.

Answer

The connection will be denied because Security Groups take precedence over NACLs.

Question 3

A security engineer is configuring AWS Network Firewall to protect a VPC. They need to implement a rule that inspects the 'Host' header of HTTP traffic to block specific unauthorized domains. Which type of rule group should be used?

Accepted Answer

Stateful rule group with domain list filtering.. AWS Network Firewall supports both stateless and stateful rule groups. Stateful rule groups use the Suricata compatible engine, which allows for deep packet inspection (DPI) of application-layer protocols like HTTP. This enables the firewall to inspect headers, such as the 'Host' header, to enforce domain-based filtering policies.

Answer

Stateless rule group with 5-tuple filtering.

Answer

AWS WAF with a web ACL associated with the VPC.

Answer

VPC Endpoint Policy associated with an S3 gateway.

Question 4

Refer to the exhibit. This policy is applied to an Amazon S3 bucket named 'sensitive-data'. What is the security implication of this policy configuration?

Accepted Answer

It prevents any access to the bucket from outside the specified VPC endpoint.. This bucket policy uses an explicit 'Deny' with a 'StringNotEquals' condition. This pattern is a powerful security control that implements a 'perimeter' around the bucket. It ensures that any request not originating from the specified VPC Endpoint (vpce-1a2b3c4d) is rejected, regardless of any other 'Allow' permissions the user might have.

Answer

It allows all users in the VPC to access the bucket if they use the specified VPC endpoint.

Answer

It only denies access to the bucket if the user is using a different VPC endpoint, but allows public access.

Answer

It restricts access to the bucket to only the root user of the account via the VPC endpoint.

Question 5

Refer to the exhibit. A security engineer has deployed this AWS WAF rule. If a single IP address sends 1,500 requests in a 5-minute window, what will happen according to this configuration?

Accepted Answer

The first 1,000 requests will be allowed, and the subsequent 500 requests will be blocked.. AWS WAF rate-based rules track the number of requests from each IP address over a sliding 5-minute window. If the number of requests exceeds the defined limit (1,000 in this case), the action (Block) is triggered. The IP will remain blocked until its request rate falls below the threshold.

Answer

All 1,500 requests will be blocked immediately by the WAF.

Answer

The IP will be added to a permanent blocklist until manually removed by an administrator.

Answer

The WAF will allow all traffic but send an alert to CloudWatch when the limit is exceeded.

Question 6

An organization is deploying a multi-tier application. Which TWO of the following configurations are required to ensure that the backend application tier in a private subnet can securely communicate with an RDS database instance while preventing direct internet access?

Accepted Answer

Configure the RDS Security Group to allow inbound traffic on the database port from the Application Security Group ID.. Proper infrastructure security relies on network isolation through private subnets and restrictive Security Group rules. By placing the RDS instance in a private subnet and configuring the application tier's security group to only permit inbound traffic on the database port from the application tier's specific security group, you minimize the attack surface. This defense-in-depth approach ensures lateral movement is blocked even if one tier is compromised.

Answer

Attach an Internet Gateway to the route table associated with the private subnet containing the RDS instance.

Answer

Configure the RDS Security Group to allow inbound traffic from the CIDR block of the VPC.

Answer

Enable Public Accessibility on the RDS instance to allow the Application tier to resolve the endpoint.

Question 7

A security engineer needs to delegate the ability to create IAM roles to a junior administrator. However, the engineer must ensure that the junior administrator cannot create roles with more permissions than they themselves possess. Which IAM feature should be used to enforce this constraint?

Accepted Answer

IAM Permissions Boundaries. While Permissions Boundaries are the correct feature, the explanation should clarify that the security engineer must use an IAM policy with a 'Condition' element (specifically 'iam:PermissionsBoundary') to force the junior administrator to attach a specific boundary to any role they create. Without this condition, the junior administrator could simply choose not to attach a boundary.

Answer

IAM Access Analyzer

Answer

Resource-based policies

Answer

Service Linked Roles

Question 8

An organization requires that their API Gateway instances only accept requests from a specific private VPC. Which strategy should be used to enforce this network-level constraint?

Accepted Answer

Configure the API Gateway with a resource policy that restricts access by 'aws:SourceVpce'.. To restrict access to an API Gateway to a specific VPC, you must deploy a Private API. Access to this API is controlled via an API Gateway Resource Policy. By using the 'aws:SourceVpce' condition key within that policy, you can explicitly allow traffic only from specific VPC Endpoints, effectively ensuring the API is only reachable from the designated private network.

Answer

Place the API Gateway in a private subnet and attach an Internet Gateway for internal traffic.

Answer

Use a Network ACL to block all IP addresses from the public internet to the API Gateway.

Answer

Set up a CloudFront distribution and point it to the API Gateway's public IP address.

Question 9

An enterprise provides a financial data service to clients via AWS PrivateLink. The security architect must ensure that only authorized consumer VPCs can connect to the Interface VPC Endpoint and that all traffic flow metadata is captured for forensic auditing. Which combination of actions meets these requirements?

Accepted Answer

Add authorized account ARNs to the Endpoint Service allowed principals and enable VPC Flow Logs on the endpoint's elastic network interfaces.. PrivateLink security is managed through a combination of service-level permissions and network-level monitoring. By adding specific AWS account ARNs to the endpoint service allowed principals list, you control which accounts can discover the service. Enabling VPC Flow Logs on the network interfaces associated with the endpoint provides the necessary metadata for auditing all connection attempts.

Answer

Attach a resource-based policy to the Interface Endpoint and enable VPC Flow Logs on the consumer VPC subnets.

Answer

Configure the Endpoint Service to require manual acceptance of connection requests and enable CloudTrail logging for the VPC.

Answer

Use a Security Group on the Interface Endpoint to restrict traffic to the consumer VPC CIDR and enable S3 Server Access Logs.

Question 10

A company is experiencing a high volume of SQL injection attempts against its web application. The application is behind an Application Load Balancer (ALB). The security team wants to block these attacks while ensuring that legitimate traffic containing technical documentation (which may include SQL-like snippets) is not accidentally blocked. What is the best approach?

Accepted Answer

Deploy the SQLi managed rule in Count mode, analyze the logs, and then apply a scope-down statement to exclude specific documentation paths.. AWS WAF Managed Rules provide robust protection against common threats like SQL injection. However, to avoid false positives on legitimate technical content, running rules in 'Count' mode first allows for analysis of the impact. Once legitimate patterns are identified, exclusions or scope-down statements can be implemented before switching the rule to 'Block' mode.

Answer

Enable the AWS Managed Rules SQL database rule set and immediately set the action to Block.

Answer

Create a custom WAF rule with a regex pattern for SQL keywords and apply it to the ALB.

Answer

Use a Network ACL to block the source IP addresses of the attackers identified in the ALB access logs.

Question 11

Refer to the exhibit. A developer is attempting to upload a file to 'my-secure-bucket' using the S3 console but receives an Access Denied error. The developer is not specifying any encryption settings during the upload. Based on the provided IAM policy, what is the reason for the failure?

Accepted Answer

The explicit Deny statement takes precedence because the upload request does not include the required KMS encryption header.. This question tests the understanding of IAM policy evaluation logic, specifically the explicit deny rule. Even if an allow statement exists, any matching deny statement will take precedence. In this scenario, the user is restricted from uploading objects unless they specify KMS encryption, which is a common requirement for maintaining data security standards within a bucket.

Answer

The S3 bucket lacks a bucket policy that explicitly allows the PutObject action for the developer.

Answer

The developer's IAM user does not have the 'kms:GenerateDataKey' permission required to encrypt the object.

Answer

The resource ARN in the policy is incorrect because it should include the bucket name without the trailing slash.

Question 12

A security engineer is using Service Control Policies (SCPs) to manage permissions across an AWS Organization. Which TWO statements accurately describe the behavior and limitations of SCPs?

Accepted Answer

SCPs affect all users and roles in the member account, including the account's root user.. SCPs are a key component of AWS Organizations for implementing guardrails across multiple accounts. They do not grant permissions but define the maximum available permissions for IAM users and roles within the targeted accounts. Understanding how SCPs interact with identity-based and resource-based policies is essential for maintaining a secure and compliant multi-account environment.

Answer

SCPs can grant permissions to an IAM user that hasn't been given access by an identity-based policy.

Answer

SCPs are applied to the management account of the organization to restrict its own administrator activities.

Answer

SCPs are used to manage resource-level permissions for cross-account access between different organizations.

Question 13

A security engineer needs to provide a third-party audit team in Account B access to S3 objects in Account A. The objects are encrypted with a Customer Managed Key (CMK) in Account A. What combination of permissions is required to allow the auditors to download and decrypt the objects?

Accepted Answer

Grant the Account B role S3 permissions in Account A's bucket policy and update the KMS key policy in Account A to include the Account B role ARN in the 'Principal' element with kms:Decrypt permissions.. To access cross-account encrypted objects, the KMS key policy in Account A must grant the external principal (Account B's role) permission to use the key. Simply adding the role ARN to the Principal element is not enough; the key policy must explicitly allow the 'kms:Decrypt' action for that principal. Additionally, the IAM policy in Account B must also grant the 'kms:Decrypt' permission to the role, as KMS permissions are evaluated against both the key policy and the IAM policy.

Answer

Attach an IAM policy to the Account B role allowing kms:Decrypt on all resources and update the Account A S3 bucket policy to allow public access to the encrypted objects.

Answer

Use an S3 Access Point in Account A to grant access to Account B and enable the 'KMS PassThrough' flag on the Access Point configuration to manage decryption.

Answer

Create a cross-account IAM role in Account A that the auditors assume, then grant that role permissions to the S3 bucket only, as S3 handles KMS decryption automatically for assumed roles.

Question 14

A security engineer is troubleshooting an IAM policy evaluation issue where an explicit deny statement inside a permissions boundary is failing to restrict permissions as expected for a developer role. Which TWO factors must the engineer verify during the evaluation process?

Accepted Answer

Confirm that the evaluated request is not using AWS account root user credentials, as permissions boundaries do not apply to the root user.. Understanding IAM evaluation logic is critical for debugging complex access control models. Permissions boundaries limit the maximum permissions an IAM entity can have, but they do not grant permissions on their own. Explicit denies anywhere in the evaluation chain will always take precedence over allows.

Answer

Verify whether the attached identity-based policy contains an explicit deny that overrides the permissions boundary constraints.

Answer

Check if an active service control policy in the organization enables permissions boundaries to be bypassed for trusted administrative roles.

Answer

Ensure that the principal is not performing an action that is exempted from permissions boundaries, such as setting up specific IAM policies.

Question 15

A company is building a mobile application that requires users to authenticate before accessing private data stored in Amazon S3 and Amazon DynamoDB. Which THREE components or features of Amazon Cognito should be used to implement this securely?

Accepted Answer

Cognito User Pools to provide a sign-in and sign-up directory for the application users.. Amazon Cognito provides a robust framework for mobile and web authentication. User Pools handle the management of user identities (sign-up/sign-in), while Identity Pools (Federated Identities) provide the mechanism to exchange those identities for temporary AWS credentials. Together with IAM roles, they ensure secure, scoped access to AWS resources.

Answer

Cognito Sync to store all user files directly from the mobile device to the cloud.

Answer

AWS Secrets Manager to store the Cognito User Pool Client Secret on the mobile device.

Question 16

A security architect is designing a cross-account data sharing solution. Account A owns a KMS Customer Managed Key (CMK) that must be used by an IAM role in Account B to decrypt S3 objects. Which TWO steps are required to enable this cross-account access?

Accepted Answer

Modify the KMS key policy in Account A to grant the IAM role in Account B permission to use the key.. Cross-account access to a KMS key requires permissions to be granted in two places: the key policy (resource-based) and the IAM policy (identity-based). The key owner must trust the external account in the key policy, and the external account's administrator must then grant specific users or roles permission to use that key.

Answer

Create a VPC Peering connection between Account A and Account B to allow KMS traffic.

Answer

Configure the IAM role in Account B to assume a role in Account A that has KMS permissions.

Answer

Enable 'KMS Multi-Region' support on the key in Account A to allow it to be seen by Account B.

Question 17

A company is setting up a private Public Key Infrastructure (PKI) on AWS to issue certificates for internal microservices. They need to ensure that the private keys of the CA are protected by a FIPS 140-2 Level 3 validated Hardware Security Module (HSM). Which service should they use?

Accepted Answer

AWS Private CA.. AWS Private CA (formerly ACM Private CA) uses FIPS 140-2 Level 3 validated HSMs to protect the private keys of the CA. This level of security is necessary for organizations that must meet high compliance standards for their internal certificate issuance and management, providing a secure, managed PKI solution.

Answer

AWS Certificate Manager (ACM) with a public certificate request.

Answer

AWS CloudHSM with a custom-built OpenSSL CA on EC2.

Answer

AWS Key Management Service (KMS) with an asymmetric key pair.

Question 18

A security auditor requires a centralized view of security findings across all AWS accounts in an organization. Which service should be enabled to aggregate and prioritize these findings?

Accepted Answer

AWS Security Hub. AWS Security Hub serves as the central hub for security posture management. By enabling Security Hub in the management account and configuring it to aggregate data from member accounts, auditors gain a unified dashboard. This is essential for maintaining governance and compliance at scale, as it correlates findings from GuardDuty, Inspector, and IAM Access Analyzer into a single actionable view, significantly reducing the operational overhead of manual account-by-account reviews.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 19

Refer to the exhibit. An administrator applied this policy to a bucket, but users are still able to upload unencrypted objects. Why is this occurring?

Accepted Answer

The condition only checks the header if it exists in the request.. The policy uses the 's3:x-amz-server-side-encryption' condition key, which is only present if the client specifically sends that header. If a user performs a standard 'PutObject' without the encryption header, the request does not match the condition, and the 'Deny' effect is not triggered. To fix this, the policy must explicitly deny requests where the header is absent, ensuring that all uploads are forced to include mandatory encryption headers.

Answer

The policy lacks a wildcard in the resource ARN.

Answer

The 'Effect' should be changed to 'Allow'.

Answer

The policy needs an 'Action' of 's3:PutObjectTagging'.

Question 20

An organization is using AWS Organizations with all features enabled. They want to prevent any account, including the management account, from being able to leave the organization. Which governance action should be taken?

Accepted Answer

Apply an SCP to the Root of the organization that denies the 'organizations:LeaveOrganization' action.. To prevent an AWS account from leaving an organization, you use Service Control Policies (SCPs) denying the 'organizations:LeaveOrganization' action. However, SCPs do not apply to the management account. The management account cannot leave the organization because it is the entity that created it; an organization cannot exist without a management account.

Answer

There is no way to prevent the management account from leaving, but member accounts are locked in automatically.

Answer

Enable 'Account Lockdown' in the AWS Organizations settings console.

Answer

Ensure that the organization was created in 'Consolidated Billing' mode only.