SCS-C03 Practice Test 5 — 10 Questions

Question 1

A company is using AWS IAM Identity Center (successor to AWS Single Sign-On) to manage access to their AWS accounts. They want to automate the process of adding and removing users based on their status in an external identity provider. Which protocol should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SCIM (System for Cross-domain Identity Management). AWS IAM Identity Center is the recommended service for managing single sign-on access to AWS accounts and business applications. It provides a centralized place to manage user identities and their access levels. For organizations with existing directories like Active Directory, Identity Center simplifies the process of provisioning users and mapping them to specific permission sets across the entire AWS Organization.

Answer

SAML 2.0 (Security Assertion Markup Language)

Answer

LDAP (Lightweight Directory Access Protocol)

Answer

OpenID Connect (OIDC)

Question 2

A company is setting up SAML 2.0 federation to allow employees to log into the AWS Management Console using their corporate credentials. Which TWO components are required to establish this trust relationship in AWS?

Accepted Answer

An IAM SAML Identity Provider entity created in the AWS account.. SAML 2.0 federation allows users to use their existing corporate credentials to access the AWS Management Console. This centralizes identity management and reduces the need for multiple sets of credentials. Configuring the trust relationship involves exchanging metadata between the Identity Provider and AWS, ensuring that the assertion contains the necessary attributes for role mapping and session management.

Answer

An IAM User with programmatic access keys for the Identity Provider.

Answer

A CloudFront distribution to cache the SAML assertion responses.

Answer

An Amazon Cognito User Pool to store the federated user profiles.

Question 3

A large enterprise wants to implement SAML 2.0-based federation to allow employees to access the AWS Management Console using their existing corporate credentials. Which TWO steps are required to establish this trust relationship and enable user access?

Accepted Answer

Create an IAM SAML identity provider in the AWS account using the metadata document provided by the corporate IdP.. Establishing SAML federation requires a mutual trust between the Identity Provider (IdP) and AWS. This involves exchanging metadata and mapping SAML attributes to AWS IAM roles. These steps ensure that AWS can verify the identity of the incoming user and assign them the correct permissions based on their corporate group membership.

Answer

Install the AWS CLI on each employee's local machine and configure it with their corporate username and password.

Answer

Enable Multi-Factor Authentication (MFA) on the AWS root user to allow SAML assertions to be processed securely.

Answer

Create individual IAM users for every employee and map them to their corresponding corporate identities using tags.

Question 4

A company is migrating a legacy database to Amazon RDS for MySQL and must ensure the data is protected according to strict compliance standards. The security team requires that the data at rest is encrypted and that the encryption cannot be disabled after the instance is created. Which TWO statements accurately describe RDS encryption behavior?

Accepted Answer

Snapshots and automated backups of an encrypted RDS instance are automatically encrypted using the same KMS key.. Amazon RDS encryption at rest is a foundational security feature that must be decided at the time of resource creation. It uses the AES-256 encryption algorithm to protect data stored on the underlying volumes, as well as backups and snapshots. Understanding the lifecycle of encrypted instances is critical for maintaining a secure data environment.

Answer

Encryption at rest can be enabled for an existing unencrypted RDS DB instance by modifying the instance settings.

Answer

Encryption at rest can be disabled on an RDS instance to improve performance during large data imports.

Answer

RDS encryption at rest only protects the database tables and does not apply to logs or temporary files.

Question 5

Refer to the exhibit. This S3 bucket policy is applied to a bucket named 'marketing-data'. What is the effect of this policy regarding access to the objects in the bucket?

Accepted Answer

It allows any IAM user or role within any account belonging to the AWS Organization 'o-1234567890' to read objects.. The PrincipalOrgID condition key is a powerful tool for restricting resource access to identities within a specific AWS Organization. This allows for broad 'Allow' statements that are still safely scoped to internal users only. Mastering this condition helps in creating scalable resource-based policies that don't require listing individual account IDs, thus reducing complexity and manual errors.

Answer

It makes the bucket public to anyone on the internet as long as they are using an AWS account.

Answer

It allows access only if the S3 bucket itself is owned by the organization 'o-1234567890'.

Answer

It requires that the request must originate from a VPC endpoint that is tagged with the organization ID.

Question 6

A security engineer is tasked with granting a developer in Account A access to an Amazon S3 bucket located in Account B. The developer needs to perform PutObject and GetObject operations. According to security best practices for cross-account access, which configuration provides the most secure and manageable solution?

Accepted Answer

Create an IAM role in Account B with the required S3 permissions and a trust policy allowing Account A, then let the developer assume it.. Cross-account access is best managed by assuming an IAM role in the destination account. This approach generates temporary security credentials via AWS STS, reducing the risk associated with long-term credentials. It centralizes permission management within the account owning the resource while allowing the source account to control which identities can initiate the switch.

Answer

Create an IAM user in Account B for the developer and provide the static access keys to the developer in Account A.

Answer

Define a resource-based policy on the S3 bucket in Account B that grants the developer's IAM ARN in Account A direct access.

Answer

Configure a VPC Peering connection between Account A and Account B to allow the developer to access the S3 bucket privately.

Question 7

A company stores sensitive PII in RDS MySQL databases. The security team wants to ensure that data is encrypted at rest and that the encryption keys are rotated annually. Which TWO actions fulfill these requirements?

Accepted Answer

Enable RDS encryption using a customer-managed key during instance creation.. Enabling RDS encryption at the time of instance creation is mandatory for at-rest protection, as this cannot be added to an existing unencrypted instance. Additionally, using AWS KMS customer-managed keys allows the administrator to control the rotation schedule manually or via automatic rotation features, ensuring the underlying cryptographic material is refreshed regularly to maintain compliance and reduce the potential impact of a compromised key.

Answer

Enable RDS encryption using an AWS managed key and configure annual rotation.

Answer

Modify the existing RDS instance to enable encryption after the initial launch.

Answer

Enable Transparent Data Encryption (TDE) via the RDS option group.

Question 8

A company uses AWS Organizations with all features enabled. A security engineer has applied a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the 'iam:CreateUser' action. However, a specific IAM user in a member account within that OU has an administrator policy attached. What is the resulting behavior when this user attempts to create a new IAM user?

Accepted Answer

The request will fail because the SCP acts as a filter that restricts the maximum permissions available to any identity in the account.. In AWS IAM evaluation logic, an explicit deny always overrides any allow, regardless of where the deny is defined. Since SCPs act as a guardrail for the entire account, any action denied at the SCP level cannot be performed by any principal within that account, including those with full administrator privileges.

Answer

The user will successfully create the new IAM user because the administrator policy provides full access that overrides the SCP.

Answer

The request will succeed only if the user uses the AWS Management Console, but it will fail if they use the AWS CLI or SDK.

Answer

The request will be sent to the master account for approval before the new IAM user is created in the member account.

Question 9

Which service should be used to protect sensitive data from being exfiltrated via API calls to unauthorized services?

Accepted Answer

VPC Endpoint Policies. VPC endpoints, specifically Interface Endpoints (powered by AWS PrivateLink), allow you to restrict traffic to specific AWS services. By using a VPC Endpoint Policy, you can restrict API calls to only those services you explicitly authorize. This provides a robust preventative control that stops data from being sent to unauthorized accounts or services, even if an identity is compromised.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

AWS Shield

Question 10

An organization wants to rotate their KMS customer-managed keys every 90 days. What is the most effective way to implement this?

Accepted Answer

Perform manual key rotation by creating a new key every 90 days.. AWS KMS automatic rotation occurs every 365 days and cannot be configured for a 90-day interval. To meet a 90-day requirement, the organization must perform manual rotation. This involves creating a new key, updating the application's key ID configuration (or using an alias), and keeping the old key active only for decrypting existing data, which is a standard procedure for strict compliance.

Answer

Modify the KMS key's rotation policy to 90 days.

Answer

Use an AWS Lambda function to trigger the rotation of the KMS key backing material.

Answer

Use AWS Secrets Manager to rotate the KMS key every 90 days.