SCS-C03 Hard Questions — 25 Difficult Questions

Question 1

Which THREE of the following are considered 'Detective' controls within the AWS security framework?

Accepted Answer

AWS CloudTrail.. Detective controls are essential for visibility and incident response, allowing security teams to understand what is happening within their environment. By using CloudTrail for auditing, GuardDuty for threat detection, and Config for compliance monitoring, organizations can effectively identify, investigate, and respond to threats. These controls provide the empirical data necessary to prove compliance and to refine preventive measures, ensuring that the overall security posture is resilient against evolving threats.

Answer

VPC Security Groups.

Answer

IAM User Permissions.

Question 2

Refer to the exhibit. The log entry shows a denied 'DeleteTable' attempt. Which service, if configured, would have automatically triggered an alert based on this specific log entry?

Accepted Answer

Amazon CloudWatch Metric Filters and Alarms.. This log entry represents an unauthorized attempt to modify critical infrastructure. To alert on this, one must integrate CloudTrail with Amazon CloudWatch Logs and establish a Metric Filter that matches the 'Denied' status and the 'DeleteTable' action. This pattern is essential for incident response, as it allows security teams to distinguish between accidental user error and potential malicious reconnaissance or destructive intent by an insider.

Answer

Amazon GuardDuty.

Answer

AWS Security Hub.

Answer

AWS Trusted Advisor.

Question 3

Refer to the exhibit. An administrator accidentally applied this bucket policy. What is the immediate impact on the ability to manage the S3 bucket?

Accepted Answer

Only the root user can still delete the bucket.. While an explicit Deny in a bucket policy overrides Allow statements, the AWS root user account is an exception. The root user can still perform actions on an S3 bucket even if a bucket policy denies access, provided the root user removes or modifies the bucket policy itself. The statement that the root user is locked out is technically inaccurate regarding the root user's inherent ability to modify bucket policies.

Answer

No user, including the root user, can delete the bucket.

Answer

The policy is invalid because a Deny statement requires an explicit Condition block.

Answer

Users can still delete the bucket if they have an Allow policy in their IAM user.

Question 4

A security analyst suspects an EC2 instance is compromised and being used for command and control (C2) communication. Which TWO actions should be performed to preserve evidence while containing the threat?

Accepted Answer

Create a snapshot of the instance's attached EBS volumes for forensic analysis.. To preserve evidence while containing the threat, modifying the security group to block all inbound and outbound traffic (Option C) stops malicious communication while keeping the instance running for memory acquisition. Creating a snapshot of the EBS volumes (Option B) preserves the disk state for later forensic analysis. Terminating or rebooting the instance (Options A and D) destroys volatile memory data (RAM) before it can be captured.

Answer

Terminate the EC2 instance immediately to stop the malicious traffic.

Answer

Reboot the instance to clear any malicious processes running in the background.

Answer

Delete all snapshots to prevent the attacker from accessing them.

Question 5

Which THREE AWS services are critical for automating an incident response plan for detecting and containing unauthorized IAM credential usage?

Accepted Answer

AWS CloudTrail. Integrating AWS CloudTrail, Amazon GuardDuty, and AWS Lambda creates an automated loop: CloudTrail logs the activity, GuardDuty detects the anomaly (unauthorized IAM use), and Lambda executes the remediation (e.g., attaching an inline deny policy). This trifecta is essential for meeting the 'Respond' function of the NIST framework within AWS, as it enables rapid, scalable intervention without requiring human intervention for common, well-defined security threats in the cloud.

Answer

AWS Glue

Answer

AWS Direct Connect

Question 6

An organization detects unauthorized access to their AWS account. They want to ensure they have an audit trail that cannot be tampered with by the attacker. Which configuration provides the highest level of integrity for CloudTrail logs?

Accepted Answer

Enabling CloudTrail log file integrity validation.. While CloudTrail log file integrity validation detects tampering, it does not prevent it. To ensure logs cannot be tampered with (deleted or modified) by an attacker, S3 Object Lock in Compliance mode should be used. If the question implies preventing tampering, the current answer is insufficient.

Answer

Storing logs in an S3 bucket with public access enabled.

Answer

Encrypting the S3 bucket with a default AWS-managed KMS key.

Answer

Using an S3 bucket in a different region than the logs.

Question 7

Which THREE of the following resource types are currently supported by IAM Access Analyzer to identify potential public or cross-account access?

Accepted Answer

Amazon S3 Buckets. IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. It does this by analyzing resource-based policies. This helps security teams identify unintended access to sensitive data or infrastructure and is a critical part of the 'Detection' domain.

Answer

Amazon DynamoDB Tables

Answer

Amazon EC2 Security Groups

Question 8

A security analyst needs to detect potential exfiltration of sensitive data from an S3 bucket that has public access blocked. Which Amazon GuardDuty feature should be configured to detect anomalous data access patterns by internal IAM users?

Accepted Answer

Activate S3 Protection in Amazon GuardDuty.. GuardDuty S3 Protection analyzes CloudTrail S3 data events to detect anomalous activities, such as unusual access patterns or data access from unexpected locations. This feature is essential for identifying compromised identities that attempt to mass-download objects. By focusing on data-level events, it provides visibility into malicious behavior that standard API monitoring might miss, ensuring that even authorized users are monitored for activity that deviates from their historical baseline profile.

Answer

Enable VPC Flow Logs analysis within GuardDuty.

Answer

Configure AWS CloudTrail Insights for the S3 management events.

Answer

Deploy Macie to monitor S3 bucket access logs.

Question 9

An organization is using AWS Direct Connect to link their on-premises data center to their AWS VPC. They have a strict requirement that all data in transit over the Direct Connect link must be encrypted at the network layer. Which solution should they implement?

Accepted Answer

Enable MACsec encryption on the Direct Connect connection.. Both MACsec (IEEE 802.1AE) and IPsec (via Site-to-Site VPN) provide network-layer encryption. MACsec provides Layer 2 encryption for Direct Connect Dedicated Connections (10 Gbps or 100 Gbps), while IPsec provides Layer 3 encryption. Since the question asks for network-layer encryption without specifying the OSI layer or connection type, both are technically correct, but MACsec is often preferred for high-throughput, low-latency requirements on supported hardware.

Answer

Use TLS/SSL for all application-level communication over the link.

Answer

Configure a Transit Gateway with VPC Peering and enable default encryption.

Question 10

A company requires all outbound internet traffic from its VPC to be inspected by a fleet of third-party firewall appliances. The solution must scale horizontally and ensure that traffic is symmetric, meaning requests and responses pass through the same firewall instance. Which architecture should the security engineer implement?

Accepted Answer

Deploy a Gateway Load Balancer and create a GWLB endpoint in the traffic-originating subnets.. Gateway Load Balancer (GWLB) is designed for deploying, scaling, and managing third-party virtual appliances. It uses the GENEVE protocol to wrap packets and maintain flow affinity, ensuring that both directions of a traffic flow are handled by the same appliance, which is critical for stateful inspection and security monitoring.

Answer

Deploy the firewalls behind an Application Load Balancer and use host-based routing.

Answer

Use a Transit Gateway with VPC Peering and ECMP enabled for load balancing.

Answer

Set up a Network Load Balancer with Proxy Protocol enabled for the firewall instances.

Question 11

Which THREE actions are essential to harden an Amazon EC2 Linux instance against unauthorized SSH access?

Accepted Answer

Disable password authentication in the '/etc/ssh/sshd_config' file.. Hardening SSH requires reducing the attack surface. Disabling password-based authentication forces the use of key pairs, which are more secure. Disabling root login prevents attackers from gaining full system privileges immediately. Implementing AWS Systems Manager Session Manager eliminates the need for open SSH ports (port 22) entirely, providing a highly secure, audited, and ephemeral way to manage instances without exposing them to the internet.

Answer

Change the default SSH port from 22 to a non-standard port like 2222.

Answer

Install a third-party antivirus agent on every EC2 instance.

Question 12

A company uses an Application Load Balancer (ALB) to route traffic to EC2 instances. A security engineer needs to ensure that only traffic originating from a specific Amazon CloudFront distribution can reach the ALB. What is the most secure way to implement this restriction?

Accepted Answer

Use a Lambda@Edge function to sign all requests with an AWS Signature Version 4.. AWS supports SigV4 for requests from CloudFront to an Application Load Balancer. By configuring CloudFront to sign requests using AWS Signature Version 4 (SigV4), the ALB can natively authenticate that the traffic originates from the specified CloudFront distribution, without requiring custom header management or reliance on frequently changing IP ranges. While custom headers (Option C) were historically common, SigV4 is the most secure and modern native method for ALB origins.

Answer

Add the CloudFront IP ranges to the ALB's Security Group inbound rules.

Answer

Configure CloudFront to use an Origin Access Control (OAC) with the ALB as the target.

Answer

Configure the ALB to only accept traffic containing a custom header set by CloudFront.

Question 13

Refer to the exhibit. An incident responder needs to access the production-data bucket to investigate a breach. They apply this policy to their IAM user, but get 'Access Denied' when running 'aws s3 ls s3://production-data'. Why?

Accepted Answer

The policy is missing the 'kms:Decrypt' permission for encrypted objects.. The policy provided only grants the 's3:ListBucket' permission, which allows the user to see the objects within the bucket. However, the 'aws s3 ls' command often requires additional permissions, such as 's3:GetBucketLocation' or 's3:ListBucket'. More importantly, if the bucket is encrypted with a KMS key, the user must also have 'kms:Decrypt' permissions, which are absent here. This is a common stumbling block in granular IAM policy management.

Answer

The user is missing the 's3:GetObject' permission.

Answer

The resource ARN is incorrectly formatted for S3.

Answer

The user needs the 's3:PutObject' permission to list files.

Question 14

A security engineer is hardening an Amazon VPC environment. To achieve defense-in-depth, the engineer needs to implement network filtering mechanisms that apply stateful inspection at the instance level and stateless inspection at the subnet boundary. Which TWO AWS features should the engineer configure to meet these requirements? (Choose two)

Accepted Answer

Amazon VPC security groups. Security groups provide stateful packet filtering directly at the elastic network interface level, automatically allowing return traffic for established connections. Network Access Control Lists (NACLs) provide stateless packet filtering at the subnet boundary, requiring explicit rules for both inbound and outbound traffic. Using both provides complementary layers of defense.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon Route 53 Resolver DNS Firewall

Question 15

Your company has a multi-account environment managed by AWS Organizations. A security incident reveals that a member account has been compromised. You must prevent the attacker from disabling CloudTrail or deleting logs in that account while maintaining central visibility. What is the most effective approach?

Accepted Answer

Use an Service Control Policy (SCP) to deny CloudTrail and log deletion.. Implementing an SCP at the Organizational Unit level is the most effective way to enforce security guardrails that cannot be circumvented by account administrators. By explicitly denying the ability to modify CloudTrail or S3 logging buckets, you ensure that the audit trail remains intact regardless of the level of access the attacker gains within the member account, thereby preserving forensic integrity across the enterprise environment.

Answer

Create an IAM policy in the compromised account to deny CloudTrail deletion.

Answer

Use AWS Config Rules to automatically re-enable CloudTrail if disabled.

Answer

Enable S3 Object Lock in compliance mode for all log buckets.

Question 16

A security incident indicates an EC2 instance is likely compromised and communicating with a C2 server. The security team needs to perform memory forensics and isolate the instance while preserving evidence. Which TWO actions should the team perform?

Accepted Answer

Snapshot the EBS volumes attached to the instance.. In an incident response scenario, capturing the volatile state of an instance is vital before isolation or termination occurs. Snapshotting the EBS volume allows for offline disk forensics, while memory dumps capture active threats that do not persist on disk. These actions follow standard digital forensics procedures to ensure evidence integrity, enabling a thorough investigation into the root cause of the compromise without losing critical data residing only in RAM.

Answer

Terminate the EC2 instance immediately to stop the data exfiltration.

Answer

Attach a new IAM role with administrative privileges to the instance.

Answer

Remove the VPC flow logs to save storage costs during the investigation.

Question 17

An enterprise organization runs critical databases in Amazon RDS within a private VPC. Compliance mandates that traffic traversing between the application servers and the database must be encrypted in transit using strict mutual TLS authentication and strong cipher suites. Which configuration should the security engineer implement?

Accepted Answer

Configure the RDS parameter group to enforce TLS, download the AWS root certificates onto application servers, and require SSL connections.. Standard RDS SSL/TLS configuration (Option B) only authenticates the server to the client. Mutual TLS (mTLS) requires the database to also verify the client's certificate. RDS does not natively support mTLS for standard database connections; this typically requires an intermediate proxy like AWS PrivateLink or an application-level proxy (e.g., Envoy/Istio) to handle the client certificate validation.

Answer

Enable transparent data encryption on the RDS instance and configure security groups to restrict traffic exclusively to application server IP addresses.

Answer

Implement AWS Shield Advanced on the database subnet to automatically encrypt all database packets traversing the internal VPC network interfaces.

Answer

Deploy a Network Load Balancer in front of the database and configure TLS termination listeners with self-signed cryptographic certificates.

Question 18

Which THREE conditions are required for a user to assume an IAM role in another account? (Select THREE)

Accepted Answer

The trusting account must have a role with a trust policy allowing the trusted account ID.. To assume a role in another account, three conditions must be met: 1) The trusting account's role must have a trust policy that permits the trusted account (or specific principal) to assume it. 2) The identity in the trusted account must have an IAM policy that grants the 'sts:AssumeRole' permission for the target role ARN. 3) The identity must programmatically call the 'sts:AssumeRole' API with the target role ARN.

Answer

The user must have the AdministratorAccess managed policy attached.

Answer

The trusting account must share the root user password with the trusted account.

Question 19

An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)

Accepted Answer

Apply SCPs at the root level to restrict specific AWS services in member accounts.. Implementing AWS Organizations allows for centralized management and governance. Service Control Policies (SCPs) act as guardrails, defining the maximum permissions allowed within an account, regardless of user identity. Combining SCPs with IAM Permission Boundaries provides a robust multi-layered defense strategy. This setup ensures that even if an administrator mistakenly grants broad permissions, the guardrails remain in effect, effectively preventing accidental or malicious privilege escalation across the entire AWS organization.

Answer

Assign IAM policies directly to the root user of every member account.

Answer

Configure individual IAM users in every account to ensure fine-grained control.

Answer

Enable AWS CloudTrail only in the primary management account.

Question 20

Which THREE actions are best practices for managing root user account security? (Select THREE)

Accepted Answer

Enable multi-factor authentication (MFA) on the root account.. The root user has unrestricted access to all resources. Therefore, it must be protected with the highest level of security. Enabling MFA, deleting access keys, and avoiding day-to-day tasks are essential. These actions minimize the risk of a full account takeover. By following these, you ensure that the root account is reserved for critical tasks like closing the account or managing specific billing configurations that cannot be delegated through IAM.

Answer

Store the root access keys in a secure, encrypted S3 bucket.

Answer

Use the root account for daily administrative tasks to simplify management.