SCS-C03 Practice Test 3 — 10 Questions

Question 1

A company is implementing a new internal web application and needs to use SSL/TLS certificates. Due to regulatory requirements, the certificates must be issued by a private Certificate Authority (CA) managed by the company, rather than a public CA. Which AWS service should be used to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Private Certificate Authority (AWS Private CA). AWS Private Certificate Authority (AWS Private CA) allows organizations to create a private CA hierarchy and issue certificates for internal use. This is essential for securing communication between internal services, devices, and users where a public trust chain is not required or is explicitly prohibited by security policies.

Answer

AWS Certificate Manager (ACM) with public certificates.

Answer

AWS CloudHSM to store and manage the private keys of the web application.

Answer

AWS Secrets Manager to store and rotate the SSL/TLS certificates.

Question 2

A company wants to eliminate the need for managing SSH keys and bastion hosts while still allowing administrators to securely access EC2 instances in private subnets. Which AWS service provides this capability and allows for centralized IAM-based access control?

Accepted Answer

AWS Systems Manager Session Manager. AWS Systems Manager Session Manager provides a secure way to manage EC2 instances without needing to open inbound ports like 22 (SSH) or 3389 (RDP). It uses the SSM Agent to establish a secure tunnel, and access is controlled entirely through IAM policies, providing a robust audit trail of all commands.

Answer

Amazon EC2 Instance Connect

Answer

AWS CloudShell

Answer

AWS Directory Service

Question 3

Refer to the exhibit. An incident responder needs to access the production-data bucket to investigate a breach. They apply this policy to their IAM user, but get 'Access Denied' when running 'aws s3 ls s3://production-data'. Why?

Accepted Answer

The policy is missing the 'kms:Decrypt' permission for encrypted objects.. The policy provided only grants the 's3:ListBucket' permission, which allows the user to see the objects within the bucket. However, the 'aws s3 ls' command often requires additional permissions, such as 's3:GetBucketLocation' or 's3:ListBucket'. More importantly, if the bucket is encrypted with a KMS key, the user must also have 'kms:Decrypt' permissions, which are absent here. This is a common stumbling block in granular IAM policy management.

Answer

The user is missing the 's3:GetObject' permission.

Answer

The resource ARN is incorrectly formatted for S3.

Answer

The user needs the 's3:PutObject' permission to list files.

Question 4

A security engineer is hardening an Amazon VPC environment. To achieve defense-in-depth, the engineer needs to implement network filtering mechanisms that apply stateful inspection at the instance level and stateless inspection at the subnet boundary. Which TWO AWS features should the engineer configure to meet these requirements? (Choose two)

Accepted Answer

Amazon VPC security groups. Security groups provide stateful packet filtering directly at the elastic network interface level, automatically allowing return traffic for established connections. Network Access Control Lists (NACLs) provide stateless packet filtering at the subnet boundary, requiring explicit rules for both inbound and outbound traffic. Using both provides complementary layers of defense.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon Route 53 Resolver DNS Firewall

Question 5

Your company has a multi-account environment managed by AWS Organizations. A security incident reveals that a member account has been compromised. You must prevent the attacker from disabling CloudTrail or deleting logs in that account while maintaining central visibility. What is the most effective approach?

Accepted Answer

Use an Service Control Policy (SCP) to deny CloudTrail and log deletion.. Implementing an SCP at the Organizational Unit level is the most effective way to enforce security guardrails that cannot be circumvented by account administrators. By explicitly denying the ability to modify CloudTrail or S3 logging buckets, you ensure that the audit trail remains intact regardless of the level of access the attacker gains within the member account, thereby preserving forensic integrity across the enterprise environment.

Answer

Create an IAM policy in the compromised account to deny CloudTrail deletion.

Answer

Use AWS Config Rules to automatically re-enable CloudTrail if disabled.

Answer

Enable S3 Object Lock in compliance mode for all log buckets.

Question 6

A security incident indicates an EC2 instance is likely compromised and communicating with a C2 server. The security team needs to perform memory forensics and isolate the instance while preserving evidence. Which TWO actions should the team perform?

Accepted Answer

Snapshot the EBS volumes attached to the instance.. In an incident response scenario, capturing the volatile state of an instance is vital before isolation or termination occurs. Snapshotting the EBS volume allows for offline disk forensics, while memory dumps capture active threats that do not persist on disk. These actions follow standard digital forensics procedures to ensure evidence integrity, enabling a thorough investigation into the root cause of the compromise without losing critical data residing only in RAM.

Answer

Terminate the EC2 instance immediately to stop the data exfiltration.

Answer

Attach a new IAM role with administrative privileges to the instance.

Answer

Remove the VPC flow logs to save storage costs during the investigation.

Question 7

A company needs to log all DNS queries made by EC2 instances within their VPC to identify potential data exfiltration via DNS tunneling. Which feature should the security engineer enable?

Accepted Answer

Route 53 Resolver Query Logging.. Route 53 Resolver Query Logging allows you to log all DNS queries made by resources within your VPC. This includes queries for public domain names, internal VPC domain names, and even queries made via Route 53 Resolver DNS Firewall, providing the visibility needed to detect anomalies like DNS tunneling.

Answer

VPC Flow Logs for all subnets.

Answer

CloudTrail management events.

Answer

Amazon GuardDuty DNS Security.

Question 8

Refer to the exhibit. An IAM user with the 'Finance' tag is trying to upload an object to the 'production-data' bucket. The upload is failing. What is the most likely cause?

Accepted Answer

The user does not have the 'Department' tag attached to their IAM principal.. The policy uses a Deny effect with a StringNotEquals condition. If the principal tag 'Department' is anything other than 'Finance', the action is denied. However, if the user's tag is missing or the principal does not have the expected tag during the request, the condition evaluates to true, triggering the Deny. This exhibit highlights how attribute-based access control (ABAC) relies heavily on accurate, consistent tagging across all principal entities.

Answer

The user is missing the required S3 permission in their IAM policy.

Answer

The S3 bucket policy is not allowing the action.

Answer

The S3 bucket is in a different AWS region.

Question 9

A security engineer must protect a multi-tier web application hosted in Amazon EC2 instances inside a private subnet. The application requires outbound internet access to download software updates, but malicious actors must never be able to initiate inbound connections to the instances. Which architecture satisfies these requirements securely?

Accepted Answer

Provision a NAT Gateway in a public subnet, and configure the private subnet route table to direct 0.0.0.0/0 traffic to that NAT Gateway.. Routing outbound traffic through a NAT Gateway ensures that instances can initiate communication with external endpoints while remaining entirely unreachable from the outside. NAT Gateways do not support inbound traffic initiation, providing a robust boundary. This design prevents direct exposure of private workloads, aligning with defense-in-depth principles for infrastructure security in AWS environments.

Answer

Attach an Elastic IP directly to each EC2 instance and remove the default route pointing to the internet gateway in the route table.

Answer

Deploy an Internet Gateway in the private subnet and associate it with the route table used by the application instances.

Answer

Configure a VPC endpoint for every external repository and remove all internet route entries from the VPC route tables entirely.

Question 10

Refer to the exhibit. A security engineer notices that despite the IP restriction, users are still unable to access the S3 bucket from within the corporate network. What is the most likely cause of this issue?

Accepted Answer

The 'Action' element is missing from the policy, causing it to be invalid.. The policy exhibit is incomplete because it lacks the 'Action' field, which is mandatory in AWS IAM and bucket policies. Without defining the action, the policy is syntactically invalid and will result in an 'Access Denied' error. Ensuring policy syntax is correct is a fundamental step in infrastructure security to prevent accidental service outages caused by misconfigured permissions or invalid JSON structures in resource-based policies.

Answer

The VPC endpoint for S3 is not configured to allow the corporate IP range.

Answer

The 'aws:SourceIp' condition key is not supported for Amazon S3 bucket policies.

Answer

The S3 bucket does not have the 'Block Public Access' feature disabled.