SCS-C03 Practice Test 8 — 10 Questions

Question 1

A security engineer needs to verify if all AWS accounts in the organization are compliant with the CIS AWS Foundations Benchmark. Which service provides a centralized compliance dashboard and the ability to run automated checks against this specific benchmark?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Security Hub. AWS Security Hub is designed for security posture management and governance. It includes built-in security standards, such as the CIS AWS Foundations Benchmark, which consist of automated checks. By enabling Security Hub across an organization, the security team gains a centralized view of compliance scores and specific failing resources across all member accounts.

Answer

AWS Trusted Advisor

Answer

AWS Config

Answer

AWS Artifact

Question 2

A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?

Accepted Answer

Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.. Implementing a multi-layered defense strategy is essential for detecting and mitigating brute-force attacks. By combining network-level blocking through WAF and host-level monitoring via CloudWatch, organizations can ensure that anomalous patterns are detected in real-time. This proactive detection allows for automated responses, such as modifying security group rules, which significantly reduces the window of opportunity for attackers to successfully compromise sensitive workloads and accounts.

Answer

Use AWS Shield Standard to mitigate Layer 7 application attacks.

Answer

Enable AWS Trusted Advisor to monitor for open security groups.

Answer

Implement AWS Inspector to scan for vulnerabilities on the instances.

Question 3

A company wants to aggregate security findings from AWS GuardDuty, AWS Inspector, and AWS Macie into a single dashboard for prioritized viewing. Which service should be used to provide this consolidated view of security alerts?

Accepted Answer

AWS Security Hub. AWS Security Hub is the primary service for aggregating, organizing, and prioritizing security findings from multiple AWS services. It provides a comprehensive view of the security state of an AWS environment by collecting data from GuardDuty, Inspector, Macie, and third-party products, facilitating a more effective incident response and compliance monitoring process.

Answer

Amazon CloudWatch ServiceLens

Answer

AWS Trusted Advisor

Answer

AWS Config Aggregator

Question 4

Which TWO actions should be taken to ensure that Amazon GuardDuty has the necessary data to detect unauthorized cryptocurrency mining instances?

Accepted Answer

Enable VPC Flow Logs in all regions.. GuardDuty relies on both VPC Flow Logs and DNS logs to identify crypto-mining patterns. Flow logs enable the detection of connections to known mining pool endpoints, while DNS logs reveal attempts to resolve these malicious domain names. Providing these inputs ensures GuardDuty's machine learning models can accurately correlate network activity with known bad actors, which is vital for maintaining the performance and integrity of the compute infrastructure against resource hijacking.

Answer

Configure CloudWatch Logs with metric filters.

Answer

Install the CloudWatch agent on all instances.

Answer

Create an IAM role for GuardDuty to access S3.

Question 5

An organization is running critical workloads on Amazon EKS and wants to detect suspicious activity at the container runtime level, such as unauthorized process execution or unexpected file access. Which GuardDuty feature should be enabled to achieve this level of visibility?

Accepted Answer

GuardDuty Runtime Monitoring. GuardDuty Runtime Monitoring for EKS provides deep visibility into container-level activities. It uses a lightweight agent (GuardDuty security agent) deployed as a DaemonSet to monitor system calls and process execution. This allows GuardDuty to detect threats that occur within the container itself, which standard VPC Flow Logs or CloudTrail cannot see.

Answer

GuardDuty EKS Audit Log Monitoring

Answer

Amazon Inspector Container Scanning

Answer

VPC Traffic Mirroring for EKS Worker Nodes

Question 6

Refer to the exhibit. This GuardDuty finding indicates that malware was detected on an EC2 instance. What is the process GuardDuty used to perform this scan without installing an agent on the instance?

Accepted Answer

It takes a snapshot of the EBS volume, restores it to a service-owned account, and scans the volume there.. GuardDuty Malware Protection performs agentless scans of EBS volumes. When a suspicious finding is triggered (like a command-and-control communication), GuardDuty creates a snapshot of the EBS volumes, shares them with a service-linked account, and then attaches them to a scanning instance to perform a malware analysis.

Answer

It uses the AWS Systems Manager (SSM) Agent to run a remote anti-virus script on the instance.

Answer

It performs deep packet inspection (DPI) on the VPC traffic to identify malware being downloaded.

Answer

It uses the GuardDuty Security Agent to perform a memory dump and analyze it for malicious strings.

Question 7

A company wants to detect when an IAM user executes a command from a suspicious IP address. Which tool can analyze historical CloudTrail data to establish a baseline of normal behavior and trigger alerts upon deviations?

Accepted Answer

Amazon GuardDuty.. Amazon GuardDuty provides automated anomaly detection based on CloudTrail, VPC Flow Logs, and DNS logs. It uses machine learning to profile typical user behavior and detects deviations such as logins from unusual locations or IP addresses associated with known malicious actors. This is crucial for environments where manual rule creation is impossible due to the sheer volume of users, as it identifies threats without requiring static IP allow-lists.

Answer

CloudWatch Contributor Insights.

Answer

AWS CloudTrail Insights.

Answer

AWS Config.

Question 8

A company is designing a hub-and-spoke network architecture using AWS Transit Gateway. They want to centralize inbound and outbound internet traffic inspection using a fleet of firewalls in a dedicated 'Security VPC'. Which TWO steps are required to ensure traffic is correctly routed for inspection? (Select TWO.)

Accepted Answer

Enable 'Appliance Mode' on the Transit Gateway VPC attachment for the Security VPC.. In a centralized inspection model, Transit Gateway (TGW) acts as the hub. Traffic from spoke VPCs must be routed to the TGW, which then uses a specific route table to forward traffic to the Security VPC. Appliance Mode must be enabled on the TGW attachment to ensure session stickiness for stateful firewalls.

Answer

Disable 'Source/Destination Check' on all Transit Gateway attachments.

Answer

Use VPC Peering between all spoke VPCs and the Security VPC to bypass the Transit Gateway.

Answer

Create a separate NAT Gateway in every spoke VPC to handle the inspection traffic locally.

Question 9

A security engineer wants to enable manual remediation of Security Hub findings directly from the AWS console. They want to be able to select a finding and trigger a specific Lambda function to isolate an instance. What is the correct way to configure this?

Accepted Answer

Create a Security Hub Custom Action and an EventBridge rule that triggers the Lambda function based on the Action ID.. Security Hub Custom Actions allow users to create custom response and remediation workflows. When a custom action is triggered by a user in the console, Security Hub sends the selected finding(s) to Amazon EventBridge. An EventBridge rule then matches the custom action ARN and triggers the associated Lambda function.

Answer

Use the Security Hub 'Auto-Remediate' feature to link a finding type directly to a Lambda function.

Answer

Configure a CloudWatch Alarm to monitor Security Hub findings and trigger an SNS topic for remediation.

Answer

Enable the 'Remediation' standard in Security Hub and select the 'Isolate EC2' managed rule.

Question 10

Refer to the exhibit. An incident responder observes that an attacker bypassed this S3 bucket policy and accessed objects from an IP address outside the 192.0.2.0/24 range. What is the most likely reason for this access?

Accepted Answer

The policy uses 'Allow' instead of 'Deny', allowing bypass by any identity with broad IAM permissions.. The bucket policy is a resource-based policy that only grants permissions; it does not explicitly deny access from other IP addresses. In AWS, if an IAM user or role has an identity-based policy allowing 's3:GetObject' on that bucket, the resource-based policy will not restrict them unless it contains an explicit Deny. This behavior highlights the importance of using explicit Deny statements when enforcing network-based access controls on sensitive resources.

Answer

The bucket policy must include a Principal element to restrict access to specific identities.

Answer

The S3 bucket is configured with a public access block that is too permissive.

Answer

The 'aws:SourceIp' condition does not function for requests made through an AWS service like CloudFront.