SCS-C03 Practice Test 7 — 10 Questions

Question 1

Refer to the exhibit. A developer is attempting to upload an object to 'my-secure-bucket' using the AWS CLI but receives an 'Access Denied' error. The developer's command was: 'aws s3 cp file.txt s3://my-secure-bucket/file.txt'. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The developer failed to include the '--sse aws:kms' parameter in the CLI command, violating the bucket policy condition.. The bucket policy explicitly denies any s3:PutObject request that does not include the SSE-KMS encryption header. The CLI command used by the developer did not specify an encryption method, causing the request to lack the required 's3:x-amz-server-side-encryption' header, which triggered the 'Deny' effect in the bucket policy.

Answer

The developer does not have the kms:GenerateDataKey permission for the default KMS key used by the bucket.

Answer

The bucket policy is missing a 'Sid' (Statement ID) which makes the policy invalid and causes S3 to default to a 'Deny' for all requests.

Answer

The 'Resource' ARN in the policy is incorrectly formatted because it uses a wildcard, which is not allowed for s3:PutObject actions.

Question 2

An organization is using Amazon Macie to protect sensitive data in S3. They want to ensure they are alerted to the presence of PII across all buckets. Which TWO actions are required to configure Macie to identify sensitive data effectively?

Accepted Answer

Create a sensitive data discovery job to scan the S3 buckets, specifying the depth and frequency of the analysis.. Amazon Macie requires both a discovery job and the proper permissions to analyze data. Discovery jobs allow you to define the scope and frequency of the scan, while the service-linked role ensures Macie has the necessary access to read the objects in your S3 buckets for analysis and classification.

Answer

Install the Macie agent on all EC2 instances that write data to the S3 buckets to classify data in real-time.

Answer

Configure S3 Event Notifications to send every new object to a Lambda function that calls the Macie 'ScanObject' API.

Answer

Enable S3 Object Lock on all buckets to allow Macie to generate findings without the risk of data being deleted during a scan.

Question 3

A company requires that all cloud resources be tagged with a 'Department' code for cost allocation and security reporting. How should they enforce this?

Accepted Answer

Use AWS Config rules to monitor tagging compliance.. AWS Config is the primary tool for auditing and ensuring resource compliance. By defining a custom or managed Config rule that checks for the existence of the 'Department' tag on resources, the organization can receive alerts when non-compliant resources are created. This ensures visibility into the state of the infrastructure and allows for timely remediation of tagging errors, supporting both financial governance and security-focused asset management.

Answer

Use AWS Budgets to force tagging.

Answer

Use an IAM policy to prevent resource creation.

Answer

Use AWS Trusted Advisor to tag resources.

Question 4

Which AWS IAM best practice ensures that users have only the permissions necessary to perform their specific business roles?

Accepted Answer

Apply the Principle of Least Privilege.. The 'Principle of Least Privilege' is the foundational concept in security governance. By ensuring that identities are granted the minimum level of access required to complete their tasks, organizations significantly reduce the blast radius if an account is compromised. This strategy prevents lateral movement and unauthorized data access, creating a much more resilient environment where security controls are proportional to the user's operational needs.

Answer

Assign the 'AdministratorAccess' policy to all users.

Answer

Use only root account credentials for all tasks.

Answer

Allow all traffic in Security Groups.

Question 5

A company is preparing for an annual regulatory audit and needs to collect evidence of their compliance with the SOC 2 framework across multiple AWS accounts. Which TWO AWS services or features should the security team use to automate the collection of evidence and download official compliance reports?

Accepted Answer

AWS Artifact. AWS Audit Manager and AWS Artifact are the primary services for governance and compliance evidence management. Audit Manager automates the process of gathering evidence from various AWS services to assess compliance with frameworks. AWS Artifact provides a central repository for on-demand access to AWS’s own security and compliance reports, which are essential for satisfying external auditors' requirements.

Answer

AWS Security Hub

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 6

A security engineer must ensure that no developer in a specific AWS Organizations member account can delete Amazon S3 buckets, even if they have AdministratorAccess. Which governance mechanism provides the most efficient and centralized way to enforce this restriction across the organizational unit?

Accepted Answer

Attach a Service Control Policy (SCP) to the Organizational Unit with a Deny statement for s3:DeleteBucket.. Service Control Policies (SCPs) function as a central guardrail within AWS Organizations, defining the maximum available permissions for accounts. They do not grant permissions but rather filter what can be granted by IAM policies. Mastering SCPs is critical for governance because they ensure that even administrative users cannot bypass organizational security mandates, providing a secondary layer of defense against unauthorized resource deletion across the entire environment.

Answer

Apply a resource-based policy to every S3 bucket that denies the s3:DeleteBucket action.

Answer

Create an IAM Permission Boundary and apply it to every IAM user and role within the member account.

Answer

Configure AWS Config rules to automatically remediate and recreate any deleted S3 buckets.

Question 7

According to the AWS Shared Responsibility Model, which of the following security tasks is the sole responsibility of the customer when using Amazon EC2 instances?

Accepted Answer

Managing and patching the guest operating system installed on the instance.. The Shared Responsibility Model distinguishes between security 'of' the cloud (AWS) and security 'in' the cloud (customer). For infrastructure services like EC2, AWS manages the physical hardware, virtualization layer, and facility security. The customer is responsible for everything from the operating system up, including patching the OS, managing firewall rules, and protecting their data.

Answer

Patching the underlying virtualization software on the physical host.

Answer

Maintaining the physical security of the data centers where instances reside.

Answer

Disposing of decommissioned physical storage drives in a secure manner.

Question 8

A company wants to implement a governance strategy that prevents any member account in the organization from disabling CloudTrail or deleting the organization-level trail. What is the most effective way to implement this while allowing account administrators to manage their own local resources?

Accepted Answer

Enable an organization trail in the management account and apply an SCP to deny CloudTrail modification in member accounts.. To maintain governance in a multi-account environment, organizational trails should be used. By creating the trail at the organization level, it is automatically deployed to all accounts. Combining this with a Service Control Policy (SCP) that denies 'cloudtrail:StopLogging' and 'cloudtrail:DeleteTrail' ensures that member accounts cannot tamper with the audit logs, providing immutable governance across the enterprise.

Answer

Create an IAM role in each member account that only the security team can assume to manage CloudTrail.

Answer

Enable AWS Config in all accounts and create a custom rule to restart CloudTrail if it is stopped.

Answer

Use AWS CloudFormation StackSets to deploy a local trail in each account with a strict resource-based policy.

Question 9

An organization wants to centralize the management of Amazon GuardDuty across 50 AWS accounts. They want the security team to be able to view and manage findings for all accounts from a single dashboard. What is the recommended governance approach?

Accepted Answer

Designate a security account as the GuardDuty delegated administrator through the AWS Organizations management account.. AWS Organizations allows for delegated administration of security services. By designating a security account as the GuardDuty delegated administrator, the organization centralizes finding management. This allows the security team to enable GuardDuty in member accounts, view all findings, and manage suppression rules from one place, ensuring consistent threat detection governance across the entire enterprise.

Answer

Use an AWS CloudFormation StackSet to enable GuardDuty and an SNS topic in every account.

Answer

Manually send invitations from the security account to each of the 49 member accounts to link them.

Answer

Configure an Amazon S3 bucket in each account to store findings and use Athena for centralized querying.

Question 10

A company wants to implement a robust governance framework for their AWS accounts using AWS Control Tower. They need to ensure that specific security guardrails are applied to their 'Financial-Apps' Organizational Unit (OU). Which TWO types of guardrails can be applied within Control Tower?

Accepted Answer

Preventive guardrails using Service Control Policies (SCPs).. AWS Control Tower provides two types of guardrails: preventive and detective. Preventive guardrails are implemented using Service Control Policies (SCPs) to block unauthorized actions. Detective guardrails are implemented using AWS Config rules to monitor and alert on non-compliant resource configurations. Together, they provide a comprehensive governance layer for managing account compliance and security.

Answer

Reactive guardrails using AWS Systems Manager Automation documents.

Answer

Proactive guardrails using IAM Permission Boundaries.

Answer

Administrative guardrails using AWS IAM Identity Center (Succeeded AWS SSO).