SCS-C03 Practice Test 4 — 10 Questions

Question 1

A security engineer needs to ensure that all EC2 instances are patched against critical vulnerabilities without exposing them to the public internet. Which architecture is most appropriate for this task?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Systems Manager with VPC endpoints to manage instances in a private subnet.. Using a combination of AWS Systems Manager (SSM) and a VPC endpoint for SSM enables management of instances in private subnets without an Internet Gateway or NAT Gateway. This setup allows the SSM agent to communicate with the AWS Systems Manager service securely over the internal AWS network. This is the optimal infrastructure security design for maintaining patching compliance while adhering to strict network isolation requirements.

Answer

Deploy a NAT Gateway in a public subnet to allow outbound traffic for patching.

Answer

Enable public IP addresses on instances and use Security Groups to restrict outbound traffic.

Answer

Manually download patches to an S3 bucket and have instances pull them locally.

Question 2

An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)

Accepted Answer

Apply SCPs at the root level to restrict specific AWS services in member accounts.. Implementing AWS Organizations allows for centralized management and governance. Service Control Policies (SCPs) act as guardrails, defining the maximum permissions allowed within an account, regardless of user identity. Combining SCPs with IAM Permission Boundaries provides a robust multi-layered defense strategy. This setup ensures that even if an administrator mistakenly grants broad permissions, the guardrails remain in effect, effectively preventing accidental or malicious privilege escalation across the entire AWS organization.

Answer

Assign IAM policies directly to the root user of every member account.

Answer

Configure individual IAM users in every account to ensure fine-grained control.

Answer

Enable AWS CloudTrail only in the primary management account.

Question 3

Which IAM configuration helps prevent the 'confused deputy' problem when accessing cross-account resources?

Accepted Answer

External ID.. The 'External ID' is specifically designed to mitigate the confused deputy problem. When a third party assumes a role in your account, they must provide a unique identifier that you have pre-shared with them. This ensures that the third party is acting on behalf of the correct customer, preventing an attacker from tricking the service into accessing the wrong account's resources. It is a critical security control for cross-account integrations.

Answer

MFA requirement on the role.

Answer

Role session name.

Answer

Source IP condition.

Question 4

Which THREE actions are best practices for managing root user account security? (Select THREE)

Accepted Answer

Enable multi-factor authentication (MFA) on the root account.. The root user has unrestricted access to all resources. Therefore, it must be protected with the highest level of security. Enabling MFA, deleting access keys, and avoiding day-to-day tasks are essential. These actions minimize the risk of a full account takeover. By following these, you ensure that the root account is reserved for critical tasks like closing the account or managing specific billing configurations that cannot be delegated through IAM.

Answer

Store the root access keys in a secure, encrypted S3 bucket.

Answer

Use the root account for daily administrative tasks to simplify management.

Question 5

An application running on EC2 needs to access DynamoDB tables. What is the most secure way to provide these permissions?

Accepted Answer

Assign an IAM role to the EC2 instance via an instance profile.. Assigning an IAM role to an EC2 instance is the secure, standard AWS approach. The instance profile automatically provides temporary credentials that the SDK uses, eliminating the need for manual key rotation or storage. This method follows the principle of least privilege by scoping access strictly to the necessary DynamoDB resources, preventing exposure of long-term credentials and simplifying maintenance for the application developers and security administrators.

Answer

Embed IAM access keys directly into the application code.

Answer

Store IAM access keys in a configuration file on the EC2 instance.

Answer

Create a public DynamoDB table to allow unauthenticated access.

Question 6

A security engineer needs to prevent IAM users from disabling CloudTrail. Which policy element is most appropriate?

Accepted Answer

Use an SCP to explicitly deny 'cloudtrail:StopLogging' for the organization.. Using an explicit 'Deny' on the 'cloudtrail:StopLogging' action in a Service Control Policy (SCP) or a Permission Boundary is the most effective way to prevent even administrators from disabling logging. By applying this as a guardrail, you ensure that audit integrity is maintained regardless of individual user privileges. This is crucial for compliance, as it creates an immutable audit trail that security teams can rely on during incident investigations.

Answer

Create an IAM policy that denies 'cloudtrail:StopLogging' to all users.

Answer

Enable MFA Delete on all CloudTrail S3 buckets.

Answer

Restrict access to the CloudTrail console via IAM groups.

Question 7

A developer in Account A needs to use an AWS KMS customer managed key (CMK) located in Account B to encrypt data. Which TWO configuration steps are necessary to allow this cross-account access?

Accepted Answer

The KMS key policy in Account B must grant the developer's IAM ARN in Account A permission to use the key.. Accessing a KMS key in a different account requires coordination between the IAM policy in the calling account and the key policy in the owning account. KMS is unique because the key policy must explicitly allow the use of the key even if an IAM policy provides permission. This double-check mechanism ensures that key owners maintain strict control over who can decrypt data.

Answer

The developer must assume a role in Account B that has permissions to the KMS key.

Answer

The KMS key in Account B must be converted to a multi-Region key to be accessible from Account A.

Answer

An IAM Peering Connection must be established between Account A and Account B.

Question 8

A company wants to identify any S3 buckets or IAM roles in their AWS account that are accessible by external AWS accounts or public users. Which AWS service provides this functionality by analyzing resource-based policies?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. This includes S3 buckets, IAM roles, and KMS keys. By analyzing resource-based policies, it provides findings that allow security engineers to verify if the access is intended, helping to prevent accidental data exposure or unauthorized cross-account access.

Answer

AWS Trusted Advisor

Answer

Amazon GuardDuty

Answer

AWS Config

Question 9

A security engineer needs to identify and protect Personally Identifiable Information (PII) stored in thousands of S3 buckets across multiple AWS accounts. The solution must provide a centralized dashboard and use machine learning to classify data. Which service is best suited for this task?

Accepted Answer

Amazon Macie. Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover and protect sensitive data in Amazon S3. Macie automatically provides an inventory of S3 buckets and can be configured to scan objects for PII, providing a centralized view of data risks.

Answer

Amazon GuardDuty

Answer

AWS Glue DataBrew

Answer

AWS Security Hub

Question 10

An auditor needs to verify which IAM policies are attached to a specific user. Which command provides this information?

Accepted Answer

aws iam list-attached-user-policies --user-name <username>. The AWS CLI is the primary tool for querying IAM metadata. The 'list-attached-user-policies' command specifically returns a list of all managed policies attached to the specified user. This is critical for security audits, where verifying the effective permissions of a principal is essential to ensure they match the requirements of their role and that no excessive privileges have been granted accidentally over time.

Answer

aws iam list-user-policies --user-name <username>

Answer

aws iam get-user-policy --user-name <username>

Answer

aws iam describe-user --user-name <username>