SCS-C03 Practice Test 6 — 10 Questions

Question 1

A financial institution requires that all data stored in S3 buckets be immutable for five years to comply with regulatory requirements. They also need to ensure that even the root user cannot delete the data or shorten the retention period. Which configuration should the security engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 Object Lock on the bucket and set a Default Retention period of five years using Compliance mode.. S3 Object Lock in Compliance mode provides the strongest immutability guarantee by preventing any user, including the root user, from deleting objects or reducing the retention period. This is essential for meeting strict regulatory requirements like SEC Rule 17a-4. Using Compliance mode ensures that the protection remains absolute throughout the entire specified duration.

Answer

Enable S3 Versioning and implement an S3 Lifecycle policy to transition objects to Glacier Deep Archive with a five-year expiration rule.

Answer

Enable S3 Object Lock on the bucket and set a Default Retention period of five years using Governance mode.

Answer

Apply a Bucket Policy with a Deny effect on the s3:DeleteObject action for all principals, including a condition that checks the current date.

Question 2

Which AWS service is best suited for providing a comprehensive, searchable audit trail of every API call made in an AWS account?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the definitive service for tracking user activity and API usage. By recording events as log files, it provides an immutable history of actions taken by users, roles, or services. This is a foundational governance requirement, as it allows security teams to reconstruct events during investigations, verify identity actions, and comply with regulatory requirements regarding data access and infrastructure modifications.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS Systems Manager

Question 3

A security team wants to identify which IAM roles in their AWS account have been granted permissions that allow access from external AWS accounts or public entities. Which AWS service should they use to automate this audit?

Accepted Answer

IAM Access Analyzer. AWS IAM Access Analyzer is designed specifically to identify resources that are shared with an external entity. It uses mathematical logic to analyze resource-based policies across S3, IAM roles, KMS keys, and more, providing a comprehensive list of findings that highlight potential unintended public or cross-account access.

Answer

AWS Secrets Manager

Answer

AWS Shield

Answer

Amazon Inspector

Question 4

An application running on an Amazon EC2 instance needs to access files in an Amazon S3 bucket. What is the most secure way to provide the application with the necessary credentials?

Accepted Answer

Assign an IAM role to the EC2 instance using an instance profile.. AWS recommends using IAM roles for EC2 instances to provide temporary credentials. This avoids the need to store sensitive access keys in application code or configuration files. The EC2 instance profile automatically manages the rotation and delivery of these credentials to the instance via the metadata service.

Answer

Store AWS access keys in a configuration file within the application's source code.

Answer

Use the root user's access keys to ensure the application has uninterrupted access to all resources.

Answer

Create an IAM user with S3 permissions and hardcode its credentials in the EC2 User Data script.

Question 5

A company wants to ensure that all new Amazon EBS volumes created in their account are automatically encrypted, regardless of whether the developer specifies encryption during the volume creation process. Which AWS feature should be used?

Accepted Answer

Enable 'EBS encryption by default' in the EC2 dashboard for each specific AWS region.. EBS encryption by default is a region-specific setting that ensures every new EBS volume and snapshot copy created in the account is encrypted. This provides a safety net for security compliance, ensuring that no unencrypted data is inadvertently stored on block storage due to human error or misconfigured automation scripts.

Answer

Create an IAM policy that denies the 'ec2:CreateVolume' action if the 'Encrypted' parameter is false.

Answer

Use an AWS Config rule to automatically delete any EBS volume that is found to be unencrypted.

Answer

Configure an S3 Bucket Policy to only allow encrypted EBS snapshots to be uploaded.

Question 6

An organization wants to enforce encryption at rest for all S3 buckets using AWS Organizations. Which TWO actions should the security team perform to ensure consistent governance?

Accepted Answer

Create an SCP that denies s3:PutObject if x-amz-server-side-encryption is not present.. Using Service Control Policies (SCPs) allows for the enforcement of security guardrails across an entire organization. By denying the 'PutObject' operation if encryption headers are missing, and creating an SCP to restrict 'CreateBucket' unless encryption is specified, the organization ensures that all new and existing data remains encrypted. This proactive governance approach prevents developers from accidentally launching non-compliant storage resources, effectively maintaining a secure infrastructure footprint.

Answer

Enable S3 Block Public Access on all accounts via AWS Organizations.

Answer

Use AWS Trusted Advisor to manually audit all buckets for encryption status.

Answer

Apply a bucket policy to every S3 bucket in the account.

Question 7

Refer to the exhibit. Why might a user in the 192.168.1.0/24 range still be denied access to the S3 bucket?

Accepted Answer

An explicit Deny statement exists elsewhere.. IAM policy logic follows the principle of implicit deny. If there is an explicit 'Deny' statement anywhere in the policy evaluation (including the bucket policy or an SCP) that contradicts this 'Allow', access will be denied. Additionally, if the user does not have the 's3:ListBucket' permission, they might be unable to navigate the bucket, even if they can retrieve a specific object when provided with the direct key path.

Answer

The CIDR range is too small for VPC traffic.

Answer

The resource ARN is missing the bucket name.

Answer

S3 does not support the 'aws:SourceIp' condition.

Question 8

A company needs to share an encrypted EBS volume snapshot with a partner's AWS account. The snapshot is encrypted with a customer-managed KMS key. What must the company do to enable this sharing?

Accepted Answer

Share the snapshot and update the KMS key policy to permit usage by the partner.. Sharing encrypted snapshots requires sharing both the snapshot and the associated KMS key. Because the partner account cannot use the owner's KMS key directly, the key policy must be modified to allow the partner account to use the key for decryption. This ensures the partner can access the encrypted data while maintaining the security of the encryption process through AWS KMS.

Answer

Copy the snapshot to an unencrypted state, then share the unencrypted snapshot.

Answer

Export the snapshot to an S3 bucket and provide the partner with the S3 URL.

Answer

Use AWS DataSync to copy the volume data directly to the partner account.

Question 9

An application in Account A needs to decrypt S3 objects in Account B using a KMS key in Account B. What is the minimal configuration required?

Accepted Answer

Update the IAM policy in Account A and the KMS key policy in Account B.. To enable cross-account access, the KMS key policy in Account B must explicitly permit the IAM role in Account A to perform 'kms:Decrypt'. Furthermore, the IAM role in Account A must also have an IAM policy granting it the permission to perform 'kms:Decrypt' on the specific KMS key ARN in Account B. Both policies must be present; if either is missing, the operation will fail.

Answer

Only update the IAM policy in Account A to allow 'kms:Decrypt'.

Answer

Only update the KMS key policy in Account B to allow the role from Account A.

Answer

Create an IAM user in Account B and provide credentials to the application.

Question 10

Which service should be used to securely store and automatically rotate database credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the standard for managing sensitive information like database credentials. It allows for secure storage, centralized access control, and, crucially, automated rotation of passwords without downtime. This governance feature is vital for compliance, as it forces regular credential cycling, which mitigates the risk of long-lived, compromised secrets being used for unauthorized database access, thereby strengthening the overall data security posture.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3

Answer

AWS KMS