SCS-C03 Practice Questions 2 — 50 Questions

Question 1

A large enterprise wants to implement SAML 2.0-based federation to allow employees to access the AWS Management Console using their existing corporate credentials. Which TWO steps are required to establish this trust relationship and enable user access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM SAML identity provider in the AWS account using the metadata document provided by the corporate IdP.. Establishing SAML federation requires a mutual trust between the Identity Provider (IdP) and AWS. This involves exchanging metadata and mapping SAML attributes to AWS IAM roles. These steps ensure that AWS can verify the identity of the incoming user and assign them the correct permissions based on their corporate group membership.

Answer

Install the AWS CLI on each employee's local machine and configure it with their corporate username and password.

Answer

Enable Multi-Factor Authentication (MFA) on the AWS root user to allow SAML assertions to be processed securely.

Answer

Create individual IAM users for every employee and map them to their corresponding corporate identities using tags.

Question 2

A company uses a centralized identity account to manage users who assume roles in various production accounts. They want to pass the user's department name as a session tag during the 'sts:AssumeRole' call to enforce fine-grained access control in the production accounts. What must be configured to support this?

Accepted Answer

The role's trust policy in the production account must allow the 'sts:TagSession' action for the identity account principal.. To pass session tags during an sts:AssumeRole call, the IAM role's trust policy must include the 'sts:TagSession' action. Additionally, the caller must have the 'sts:TagSession' permission. The explanation should explicitly mention that the trust policy must allow the 'sts:TagSession' action to authorize the passing of tags during the assumption process.

Answer

The production account's role must have a resource-based policy allowing the 'iam:TagSession' action.

Answer

The user in the identity account must have the 'iam:AddUserToGroup' permission for the production group.

Answer

The department name must be added as a permanent tag to the IAM role itself in the production account.

Question 3

A company is migrating a legacy database to Amazon RDS for MySQL and must ensure the data is protected according to strict compliance standards. The security team requires that the data at rest is encrypted and that the encryption cannot be disabled after the instance is created. Which TWO statements accurately describe RDS encryption behavior?

Accepted Answer

Snapshots and automated backups of an encrypted RDS instance are automatically encrypted using the same KMS key.. Amazon RDS encryption at rest is a foundational security feature that must be decided at the time of resource creation. It uses the AES-256 encryption algorithm to protect data stored on the underlying volumes, as well as backups and snapshots. Understanding the lifecycle of encrypted instances is critical for maintaining a secure data environment.

Answer

Encryption at rest can be enabled for an existing unencrypted RDS DB instance by modifying the instance settings.

Answer

Encryption at rest can be disabled on an RDS instance to improve performance during large data imports.

Answer

RDS encryption at rest only protects the database tables and does not apply to logs or temporary files.

Question 4

Which of the following is considered a security best practice for managing the AWS account root user?

Accepted Answer

Enable Multi-Factor Authentication (MFA) and only use the root user for tasks that specifically require it.. The AWS account root user has unrestricted access to all resources and services in the account. Protecting this identity is the highest priority in AWS security. Best practices include avoiding the use of the root user for daily tasks, enabling multi-factor authentication, and securely storing the credentials. Most administrative tasks should be performed using IAM roles with the AdministratorAccess policy.

Answer

Create an IAM policy that denies all actions for the root user to prevent accidental changes.

Answer

Share the root user credentials with all senior administrators so that there is always a backup available.

Answer

Generate an access key for the root user and use it for automated scripts that require high privileges.

Question 5

Refer to the exhibit. This S3 bucket policy is applied to a bucket named 'marketing-data'. What is the effect of this policy regarding access to the objects in the bucket?

Accepted Answer

It allows any IAM user or role within any account belonging to the AWS Organization 'o-1234567890' to read objects.. The PrincipalOrgID condition key is a powerful tool for restricting resource access to identities within a specific AWS Organization. This allows for broad 'Allow' statements that are still safely scoped to internal users only. Mastering this condition helps in creating scalable resource-based policies that don't require listing individual account IDs, thus reducing complexity and manual errors.

Answer

It makes the bucket public to anyone on the internet as long as they are using an AWS account.

Answer

It allows access only if the S3 bucket itself is owned by the organization 'o-1234567890'.

Answer

It requires that the request must originate from a VPC endpoint that is tagged with the organization ID.

Question 6

A company needs to encrypt data at rest for an Amazon Aurora database. They want to ensure that they maintain full control over the KMS key used for encryption. What is the correct approach?

Accepted Answer

Enable storage encryption during the Aurora cluster creation using a customer-managed key.. Using a customer-managed KMS key (CMK) is the correct way to maintain full control. AWS-managed keys do not allow users to modify the key policy or rotation settings. By creating a CMK, the security team can define the key policy, enabling them to audit access, rotate the key on a specific schedule, and grant cross-account permissions as needed for their data protection requirements.

Answer

Enable encryption using the default AWS-managed key for Aurora.

Answer

Use AWS CloudHSM to manage the encryption keys for the Aurora database.

Answer

Enable TDE (Transparent Data Encryption) in the Aurora parameter group.

Question 7

A security engineer is tasked with granting a developer in Account A access to an Amazon S3 bucket located in Account B. The developer needs to perform PutObject and GetObject operations. According to security best practices for cross-account access, which configuration provides the most secure and manageable solution?

Accepted Answer

Create an IAM role in Account B with the required S3 permissions and a trust policy allowing Account A, then let the developer assume it.. Cross-account access is best managed by assuming an IAM role in the destination account. This approach generates temporary security credentials via AWS STS, reducing the risk associated with long-term credentials. It centralizes permission management within the account owning the resource while allowing the source account to control which identities can initiate the switch.

Answer

Create an IAM user in Account B for the developer and provide the static access keys to the developer in Account A.

Answer

Define a resource-based policy on the S3 bucket in Account B that grants the developer's IAM ARN in Account A direct access.

Answer

Configure a VPC Peering connection between Account A and Account B to allow the developer to access the S3 bucket privately.

Question 8

A company stores sensitive PII in RDS MySQL databases. The security team wants to ensure that data is encrypted at rest and that the encryption keys are rotated annually. Which TWO actions fulfill these requirements?

Accepted Answer

Enable RDS encryption using a customer-managed key during instance creation.. Enabling RDS encryption at the time of instance creation is mandatory for at-rest protection, as this cannot be added to an existing unencrypted instance. Additionally, using AWS KMS customer-managed keys allows the administrator to control the rotation schedule manually or via automatic rotation features, ensuring the underlying cryptographic material is refreshed regularly to maintain compliance and reduce the potential impact of a compromised key.

Answer

Enable RDS encryption using an AWS managed key and configure annual rotation.

Answer

Modify the existing RDS instance to enable encryption after the initial launch.

Answer

Enable Transparent Data Encryption (TDE) via the RDS option group.

Question 9

A company uses AWS Organizations with all features enabled. A security engineer has applied a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly denies the 'iam:CreateUser' action. However, a specific IAM user in a member account within that OU has an administrator policy attached. What is the resulting behavior when this user attempts to create a new IAM user?

Accepted Answer

The request will fail because the SCP acts as a filter that restricts the maximum permissions available to any identity in the account.. In AWS IAM evaluation logic, an explicit deny always overrides any allow, regardless of where the deny is defined. Since SCPs act as a guardrail for the entire account, any action denied at the SCP level cannot be performed by any principal within that account, including those with full administrator privileges.

Answer

The user will successfully create the new IAM user because the administrator policy provides full access that overrides the SCP.

Answer

The request will succeed only if the user uses the AWS Management Console, but it will fail if they use the AWS CLI or SDK.

Answer

The request will be sent to the master account for approval before the new IAM user is created in the member account.

Question 10

Which service should be used to protect sensitive data from being exfiltrated via API calls to unauthorized services?

Accepted Answer

VPC Endpoint Policies. VPC endpoints, specifically Interface Endpoints (powered by AWS PrivateLink), allow you to restrict traffic to specific AWS services. By using a VPC Endpoint Policy, you can restrict API calls to only those services you explicitly authorize. This provides a robust preventative control that stops data from being sent to unauthorized accounts or services, even if an identity is compromised.

Answer

AWS WAF

Answer

AWS CloudTrail

Answer

AWS Shield

Question 11

Which THREE of the following are valid methods for securing data in transit for AWS services?

Accepted Answer

Enforce HTTPS/TLS for all communication to and from AWS services.. Securing data in transit involves ensuring that communications are encrypted using secure protocols like TLS. Using VPC endpoints ensures that traffic between VPC resources and AWS services stays within the AWS network, preventing traversal over the public internet. AWS Site-to-Site VPN provides an encrypted tunnel for traffic between on-premises networks and AWS. Options C and E relate to data at rest and data integrity/retention, not data in transit.

Answer

Store data in an S3 bucket with 'Block Public Access' enabled.

Answer

Enable S3 Object Lock to prevent object deletion.

Question 12

An organization wants to rotate their KMS customer-managed keys every 90 days. What is the most effective way to implement this?

Accepted Answer

Perform manual key rotation by creating a new key every 90 days.. AWS KMS automatic rotation occurs every 365 days and cannot be configured for a 90-day interval. To meet a 90-day requirement, the organization must perform manual rotation. This involves creating a new key, updating the application's key ID configuration (or using an alias), and keeping the old key active only for decrypting existing data, which is a standard procedure for strict compliance.

Answer

Modify the KMS key's rotation policy to 90 days.

Answer

Use an AWS Lambda function to trigger the rotation of the KMS key backing material.

Answer

Use AWS Secrets Manager to rotate the KMS key every 90 days.

Question 13

A financial institution requires that all data stored in S3 buckets be immutable for five years to comply with regulatory requirements. They also need to ensure that even the root user cannot delete the data or shorten the retention period. Which configuration should the security engineer implement?

Accepted Answer

Enable S3 Object Lock on the bucket and set a Default Retention period of five years using Compliance mode.. S3 Object Lock in Compliance mode provides the strongest immutability guarantee by preventing any user, including the root user, from deleting objects or reducing the retention period. This is essential for meeting strict regulatory requirements like SEC Rule 17a-4. Using Compliance mode ensures that the protection remains absolute throughout the entire specified duration.

Answer

Enable S3 Versioning and implement an S3 Lifecycle policy to transition objects to Glacier Deep Archive with a five-year expiration rule.

Answer

Enable S3 Object Lock on the bucket and set a Default Retention period of five years using Governance mode.

Answer

Apply a Bucket Policy with a Deny effect on the s3:DeleteObject action for all principals, including a condition that checks the current date.

Question 14

Which AWS service is best suited for providing a comprehensive, searchable audit trail of every API call made in an AWS account?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the definitive service for tracking user activity and API usage. By recording events as log files, it provides an immutable history of actions taken by users, roles, or services. This is a foundational governance requirement, as it allows security teams to reconstruct events during investigations, verify identity actions, and comply with regulatory requirements regarding data access and infrastructure modifications.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS Systems Manager

Question 15

An organization needs to store compliance records in Amazon S3. The records must not be deleted or overwritten by any user, including the root user, for a period of five years. Which S3 feature provides this level of data protection?

Accepted Answer

S3 Object Lock in Compliance mode.. S3 Object Lock provides a 'Write Once Read Many' (WORM) model. In 'Compliance mode', an object version cannot be overwritten or deleted by any user, including the root user in your AWS account. This is the strongest form of protection for data that must be preserved for regulatory or legal reasons.

Answer

S3 Object Lock in Governance mode.

Answer

S3 Bucket Policies with an explicit Deny for 's3:DeleteObject'.

Answer

Amazon S3 Glacier with a Vault Lock policy.

Question 16

A security team wants to identify which IAM roles in their AWS account have been granted permissions that allow access from external AWS accounts or public entities. Which AWS service should they use to automate this audit?

Accepted Answer

IAM Access Analyzer. AWS IAM Access Analyzer is designed specifically to identify resources that are shared with an external entity. It uses mathematical logic to analyze resource-based policies across S3, IAM roles, KMS keys, and more, providing a comprehensive list of findings that highlight potential unintended public or cross-account access.

Answer

AWS Secrets Manager

Answer

AWS Shield

Answer

Amazon Inspector

Question 17

An application running on an Amazon EC2 instance needs to access files in an Amazon S3 bucket. What is the most secure way to provide the application with the necessary credentials?

Accepted Answer

Assign an IAM role to the EC2 instance using an instance profile.. AWS recommends using IAM roles for EC2 instances to provide temporary credentials. This avoids the need to store sensitive access keys in application code or configuration files. The EC2 instance profile automatically manages the rotation and delivery of these credentials to the instance via the metadata service.

Answer

Store AWS access keys in a configuration file within the application's source code.

Answer

Use the root user's access keys to ensure the application has uninterrupted access to all resources.

Answer

Create an IAM user with S3 permissions and hardcode its credentials in the EC2 User Data script.

Question 18

A company wants to ensure that all new Amazon EBS volumes created in their account are automatically encrypted, regardless of whether the developer specifies encryption during the volume creation process. Which AWS feature should be used?

Accepted Answer

Enable 'EBS encryption by default' in the EC2 dashboard for each specific AWS region.. EBS encryption by default is a region-specific setting that ensures every new EBS volume and snapshot copy created in the account is encrypted. This provides a safety net for security compliance, ensuring that no unencrypted data is inadvertently stored on block storage due to human error or misconfigured automation scripts.

Answer

Create an IAM policy that denies the 'ec2:CreateVolume' action if the 'Encrypted' parameter is false.

Answer

Use an AWS Config rule to automatically delete any EBS volume that is found to be unencrypted.

Answer

Configure an S3 Bucket Policy to only allow encrypted EBS snapshots to be uploaded.

Question 19

An organization wants to enforce encryption at rest for all S3 buckets using AWS Organizations. Which TWO actions should the security team perform to ensure consistent governance?

Accepted Answer

Create an SCP that denies s3:PutObject if x-amz-server-side-encryption is not present.. Using Service Control Policies (SCPs) allows for the enforcement of security guardrails across an entire organization. By denying the 'PutObject' operation if encryption headers are missing, and creating an SCP to restrict 'CreateBucket' unless encryption is specified, the organization ensures that all new and existing data remains encrypted. This proactive governance approach prevents developers from accidentally launching non-compliant storage resources, effectively maintaining a secure infrastructure footprint.

Answer

Enable S3 Block Public Access on all accounts via AWS Organizations.

Answer

Use AWS Trusted Advisor to manually audit all buckets for encryption status.

Answer

Apply a bucket policy to every S3 bucket in the account.

Question 20

Refer to the exhibit. Why might a user in the 192.168.1.0/24 range still be denied access to the S3 bucket?

Accepted Answer

An explicit Deny statement exists elsewhere.. IAM policy logic follows the principle of implicit deny. If there is an explicit 'Deny' statement anywhere in the policy evaluation (including the bucket policy or an SCP) that contradicts this 'Allow', access will be denied. Additionally, if the user does not have the 's3:ListBucket' permission, they might be unable to navigate the bucket, even if they can retrieve a specific object when provided with the direct key path.

Answer

The CIDR range is too small for VPC traffic.

Answer

The resource ARN is missing the bucket name.

Answer

S3 does not support the 'aws:SourceIp' condition.