SCS-C03 Practice Test 9 — 10 Questions

Question 1

An organization is preparing for a potential incident and wants to ensure that responders can quickly access logs across multiple accounts. Which architecture is recommended for centralized log management?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Aggregate logs into a dedicated, centralized security account.. Creating a dedicated, separate Log Archive account is the industry standard for centralized log management. By aggregating CloudTrail and other logs into a single, hardened account with restricted access, the organization ensures that even if a production account is fully compromised, the audit trail remains secure and available for forensic investigation. This architecture prevents an attacker from destroying the evidence of their actions within the production environments.

Answer

Store logs locally in each account within a private S3 bucket.

Answer

Enable CloudTrail logs to be sent directly to an on-premises SIEM.

Answer

Use CloudWatch Logs to stream all data to an Amazon OpenSearch cluster.

Question 2

A security engineer investigating a security alert discovers that an IAM role in an AWS account has been modified by an unknown external entity. The engineer needs to determine the exact API call that introduced the malicious policy change and identify the associated source IP address. Which AWS service provides the most definitive and historically accurate audit trail for this investigation?

Accepted Answer

Search AWS CloudTrail management event history using Amazon Athena or the AWS CLI to extract the specific PutRolePolicy event record.. AWS CloudTrail records all API calls and management events across the AWS environment, capturing caller identity, source IP addresses, and exact timestamps. By querying CloudTrail logs, security teams can reconstruct the entire attack chain, determine the extent of credential compromise, and identify policy modifications accurately. This historical record is foundational for effective cloud security incident response and forensic analysis.

Answer

Query Amazon CloudWatch Logs metric filters to identify anomalous spikes in IAM role modification API error rates.

Answer

Analyze Amazon VPC Flow Logs to trace inbound TCP connections targeting the AWS Management Console during the suspected modification window.

Answer

Review AWS Trusted Advisor security recommendations to identify unencrypted IAM policies and overly permissive trust relationships.

Question 3

An incident response team discovers an unauthorized IAM user created an access key in a production environment. The team must identify the exact time of key creation and the IP address used for the call. Which AWS service provides this forensic detail?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the primary service for auditing API calls within an AWS account. It logs the identity of the caller, the time of the event, the source IP address, and the specific request parameters. In incident response, CloudTrail is critical for reconstructing a timeline of events and determining the scope of unauthorized access, ensuring that remediation efforts are targeted and effective based on accurate forensic data.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS CloudWatch Metrics

Question 4

During a security incident involving suspected data exfiltration from an S3 bucket, which THREE sources provide the most relevant telemetry to determine what files were accessed?

Accepted Answer

CloudTrail Data Events. Determining S3 data access requires combining different logging layers. S3 Server Access Logs provide basic request data, while CloudTrail Data Events provide granular information about specific object-level API calls. VPC Flow Logs are essential if the access was routed through a VPC endpoint. Using these three sources allows the investigator to correlate network traffic with specific identity-based API requests, providing a comprehensive view of the exfiltration activity.

Answer

AWS WAF Logs

Answer

AWS Trusted Advisor reports

Question 5

Refer to the exhibit. A user is attempting to connect to a web server from the IP address 203.0.113.5 on port 80. Based on the provided Network ACL and Security Group configurations, what will be the result of this connection attempt?

Accepted Answer

The connection will be denied because the NACL Rule 100 is evaluated first.. Network ACLs (NACLs) are processed before Security Groups for inbound traffic entering a subnet. NACLs are stateless and process rules in numerical order. In this scenario, Rule 100 in the NACL explicitly denies traffic from the specific IP address, so the packet is dropped before it can be evaluated by the Security Group.

Answer

The connection will be allowed because the Security Group permits all traffic on port 80.

Answer

The connection will be allowed because NACL Rule 200 permits all traffic on port 80.

Answer

The connection will be denied because Security Groups take precedence over NACLs.

Question 6

A security engineer is configuring AWS Network Firewall to protect a VPC. They need to implement a rule that inspects the 'Host' header of HTTP traffic to block specific unauthorized domains. Which type of rule group should be used?

Accepted Answer

Stateful rule group with domain list filtering.. AWS Network Firewall supports both stateless and stateful rule groups. Stateful rule groups use the Suricata compatible engine, which allows for deep packet inspection (DPI) of application-layer protocols like HTTP. This enables the firewall to inspect headers, such as the 'Host' header, to enforce domain-based filtering policies.

Answer

Stateless rule group with 5-tuple filtering.

Answer

AWS WAF with a web ACL associated with the VPC.

Answer

VPC Endpoint Policy associated with an S3 gateway.

Question 7

Refer to the exhibit. This policy is applied to an Amazon S3 bucket named 'sensitive-data'. What is the security implication of this policy configuration?

Accepted Answer

It prevents any access to the bucket from outside the specified VPC endpoint.. This bucket policy uses an explicit 'Deny' with a 'StringNotEquals' condition. This pattern is a powerful security control that implements a 'perimeter' around the bucket. It ensures that any request not originating from the specified VPC Endpoint (vpce-1a2b3c4d) is rejected, regardless of any other 'Allow' permissions the user might have.

Answer

It allows all users in the VPC to access the bucket if they use the specified VPC endpoint.

Answer

It only denies access to the bucket if the user is using a different VPC endpoint, but allows public access.

Answer

It restricts access to the bucket to only the root user of the account via the VPC endpoint.

Question 8

Refer to the exhibit. A security engineer has deployed this AWS WAF rule. If a single IP address sends 1,500 requests in a 5-minute window, what will happen according to this configuration?

Accepted Answer

The first 1,000 requests will be allowed, and the subsequent 500 requests will be blocked.. AWS WAF rate-based rules track the number of requests from each IP address over a sliding 5-minute window. If the number of requests exceeds the defined limit (1,000 in this case), the action (Block) is triggered. The IP will remain blocked until its request rate falls below the threshold.

Answer

All 1,500 requests will be blocked immediately by the WAF.

Answer

The IP will be added to a permanent blocklist until manually removed by an administrator.

Answer

The WAF will allow all traffic but send an alert to CloudWatch when the limit is exceeded.

Question 9

An organization is deploying a multi-tier application. Which TWO of the following configurations are required to ensure that the backend application tier in a private subnet can securely communicate with an RDS database instance while preventing direct internet access?

Accepted Answer

Configure the RDS Security Group to allow inbound traffic on the database port from the Application Security Group ID.. Proper infrastructure security relies on network isolation through private subnets and restrictive Security Group rules. By placing the RDS instance in a private subnet and configuring the application tier's security group to only permit inbound traffic on the database port from the application tier's specific security group, you minimize the attack surface. This defense-in-depth approach ensures lateral movement is blocked even if one tier is compromised.

Answer

Attach an Internet Gateway to the route table associated with the private subnet containing the RDS instance.

Answer

Configure the RDS Security Group to allow inbound traffic from the CIDR block of the VPC.

Answer

Enable Public Accessibility on the RDS instance to allow the Application tier to resolve the endpoint.

Question 10

An enterprise provides a financial data service to clients via AWS PrivateLink. The security architect must ensure that only authorized consumer VPCs can connect to the Interface VPC Endpoint and that all traffic flow metadata is captured for forensic auditing. Which combination of actions meets these requirements?

Accepted Answer

Add authorized account ARNs to the Endpoint Service allowed principals and enable VPC Flow Logs on the endpoint's elastic network interfaces.. PrivateLink security is managed through a combination of service-level permissions and network-level monitoring. By adding specific AWS account ARNs to the endpoint service allowed principals list, you control which accounts can discover the service. Enabling VPC Flow Logs on the network interfaces associated with the endpoint provides the necessary metadata for auditing all connection attempts.

Answer

Attach a resource-based policy to the Interface Endpoint and enable VPC Flow Logs on the consumer VPC subnets.

Answer

Configure the Endpoint Service to require manual acceptance of connection requests and enable CloudTrail logging for the VPC.

Answer

Use a Security Group on the Interface Endpoint to restrict traffic to the consumer VPC CIDR and enable S3 Server Access Logs.