SCS-C03 Multiple Select — 20 Questions

Question 1

An organization wants to improve its vulnerability management posture by ensuring that all Amazon EC2 instances are regularly scanned for software vulnerabilities and unintended network exposure. Which TWO features of Amazon Inspector help achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Continuous scanning for software vulnerabilities in installed packages.. Amazon Inspector is an automated vulnerability management service. It continuously scans EC2 instances for software vulnerabilities (using the SSM Agent) and network reachability issues. This dual approach ensures that both internal software flaws and external configuration weaknesses are identified and reported to the security team.

Answer

Automated remediation of insecure Security Group rules.

Answer

Real-time detection of brute-force login attempts.

Answer

Malware scanning for EBS volumes attached to instances.

Question 2

Which THREE of the following resource types are currently supported by IAM Access Analyzer to identify potential public or cross-account access?

Accepted Answer

Amazon S3 Buckets. IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. It does this by analyzing resource-based policies. This helps security teams identify unintended access to sensitive data or infrastructure and is a critical part of the 'Detection' domain.

Answer

Amazon DynamoDB Tables

Answer

Amazon EC2 Security Groups

Question 3

An organization wants to improve their ability to respond to security incidents. Which TWO of the following services provide centralized visibility and management for security findings?

Accepted Answer

AWS Security Hub. AWS Security Hub and Amazon Detective are designed to aggregate, manage, and investigate security data. Security Hub acts as the central pane of glass for findings from various AWS services, while Detective provides the visualization tools needed to investigate the root cause of those findings. Together, they streamline the identification and triage process, allowing responders to move quickly from alert to conclusion during a security incident.

Answer

Amazon CloudWatch

Answer

AWS Artifact

Answer

AWS Systems Manager

Question 4

Which THREE actions are essential to harden an Amazon EC2 Linux instance against unauthorized SSH access?

Accepted Answer

Disable password authentication in the '/etc/ssh/sshd_config' file.. Hardening SSH requires reducing the attack surface. Disabling password-based authentication forces the use of key pairs, which are more secure. Disabling root login prevents attackers from gaining full system privileges immediately. Implementing AWS Systems Manager Session Manager eliminates the need for open SSH ports (port 22) entirely, providing a highly secure, audited, and ephemeral way to manage instances without exposing them to the internet.

Answer

Change the default SSH port from 22 to a non-standard port like 2222.

Answer

Install a third-party antivirus agent on every EC2 instance.

Question 5

A security engineer is hardening an Amazon VPC environment. To achieve defense-in-depth, the engineer needs to implement network filtering mechanisms that apply stateful inspection at the instance level and stateless inspection at the subnet boundary. Which TWO AWS features should the engineer configure to meet these requirements? (Choose two)

Accepted Answer

Amazon VPC security groups. Security groups provide stateful packet filtering directly at the elastic network interface level, automatically allowing return traffic for established connections. Network Access Control Lists (NACLs) provide stateless packet filtering at the subnet boundary, requiring explicit rules for both inbound and outbound traffic. Using both provides complementary layers of defense.

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Answer

Amazon Route 53 Resolver DNS Firewall

Question 6

A security incident indicates an EC2 instance is likely compromised and communicating with a C2 server. The security team needs to perform memory forensics and isolate the instance while preserving evidence. Which TWO actions should the team perform?

Accepted Answer

Snapshot the EBS volumes attached to the instance.. In an incident response scenario, capturing the volatile state of an instance is vital before isolation or termination occurs. Snapshotting the EBS volume allows for offline disk forensics, while memory dumps capture active threats that do not persist on disk. These actions follow standard digital forensics procedures to ensure evidence integrity, enabling a thorough investigation into the root cause of the compromise without losing critical data residing only in RAM.

Answer

Terminate the EC2 instance immediately to stop the data exfiltration.

Answer

Attach a new IAM role with administrative privileges to the instance.

Answer

Remove the VPC flow logs to save storage costs during the investigation.

Question 7

An organization is migrating to AWS and needs to enforce security guardrails across multiple accounts. Which TWO actions should the security team perform to ensure compliance? (Select TWO)

Accepted Answer

Apply SCPs at the root level to restrict specific AWS services in member accounts.. Implementing AWS Organizations allows for centralized management and governance. Service Control Policies (SCPs) act as guardrails, defining the maximum permissions allowed within an account, regardless of user identity. Combining SCPs with IAM Permission Boundaries provides a robust multi-layered defense strategy. This setup ensures that even if an administrator mistakenly grants broad permissions, the guardrails remain in effect, effectively preventing accidental or malicious privilege escalation across the entire AWS organization.

Answer

Assign IAM policies directly to the root user of every member account.

Answer

Configure individual IAM users in every account to ensure fine-grained control.

Answer

Enable AWS CloudTrail only in the primary management account.

Question 8

Which THREE actions are best practices for managing root user account security? (Select THREE)

Accepted Answer

Enable multi-factor authentication (MFA) on the root account.. The root user has unrestricted access to all resources. Therefore, it must be protected with the highest level of security. Enabling MFA, deleting access keys, and avoiding day-to-day tasks are essential. These actions minimize the risk of a full account takeover. By following these, you ensure that the root account is reserved for critical tasks like closing the account or managing specific billing configurations that cannot be delegated through IAM.

Answer

Store the root access keys in a secure, encrypted S3 bucket.

Answer

Use the root account for daily administrative tasks to simplify management.

Question 9

A developer in Account A needs to use an AWS KMS customer managed key (CMK) located in Account B to encrypt data. Which TWO configuration steps are necessary to allow this cross-account access?

Accepted Answer

The KMS key policy in Account B must grant the developer's IAM ARN in Account A permission to use the key.. Accessing a KMS key in a different account requires coordination between the IAM policy in the calling account and the key policy in the owning account. KMS is unique because the key policy must explicitly allow the use of the key even if an IAM policy provides permission. This double-check mechanism ensures that key owners maintain strict control over who can decrypt data.

Answer

The developer must assume a role in Account B that has permissions to the KMS key.

Answer

The KMS key in Account B must be converted to a multi-Region key to be accessible from Account A.

Answer

An IAM Peering Connection must be established between Account A and Account B.

Question 10

A company is setting up SAML 2.0 federation to allow employees to log into the AWS Management Console using their corporate credentials. Which TWO components are required to establish this trust relationship in AWS?

Accepted Answer

An IAM SAML Identity Provider entity created in the AWS account.. SAML 2.0 federation allows users to use their existing corporate credentials to access the AWS Management Console. This centralizes identity management and reduces the need for multiple sets of credentials. Configuring the trust relationship involves exchanging metadata between the Identity Provider and AWS, ensuring that the assertion contains the necessary attributes for role mapping and session management.

Answer

An IAM User with programmatic access keys for the Identity Provider.

Answer

A CloudFront distribution to cache the SAML assertion responses.

Answer

An Amazon Cognito User Pool to store the federated user profiles.

Question 11

A large enterprise wants to implement SAML 2.0-based federation to allow employees to access the AWS Management Console using their existing corporate credentials. Which TWO steps are required to establish this trust relationship and enable user access?

Accepted Answer

Create an IAM SAML identity provider in the AWS account using the metadata document provided by the corporate IdP.. Establishing SAML federation requires a mutual trust between the Identity Provider (IdP) and AWS. This involves exchanging metadata and mapping SAML attributes to AWS IAM roles. These steps ensure that AWS can verify the identity of the incoming user and assign them the correct permissions based on their corporate group membership.

Answer

Install the AWS CLI on each employee's local machine and configure it with their corporate username and password.

Answer

Enable Multi-Factor Authentication (MFA) on the AWS root user to allow SAML assertions to be processed securely.

Answer

Create individual IAM users for every employee and map them to their corresponding corporate identities using tags.

Question 12

A company is migrating a legacy database to Amazon RDS for MySQL and must ensure the data is protected according to strict compliance standards. The security team requires that the data at rest is encrypted and that the encryption cannot be disabled after the instance is created. Which TWO statements accurately describe RDS encryption behavior?

Accepted Answer

Snapshots and automated backups of an encrypted RDS instance are automatically encrypted using the same KMS key.. Amazon RDS encryption at rest is a foundational security feature that must be decided at the time of resource creation. It uses the AES-256 encryption algorithm to protect data stored on the underlying volumes, as well as backups and snapshots. Understanding the lifecycle of encrypted instances is critical for maintaining a secure data environment.

Answer

Encryption at rest can be enabled for an existing unencrypted RDS DB instance by modifying the instance settings.

Answer

Encryption at rest can be disabled on an RDS instance to improve performance during large data imports.

Answer

RDS encryption at rest only protects the database tables and does not apply to logs or temporary files.

Question 13

A company stores sensitive PII in RDS MySQL databases. The security team wants to ensure that data is encrypted at rest and that the encryption keys are rotated annually. Which TWO actions fulfill these requirements?

Accepted Answer

Enable RDS encryption using a customer-managed key during instance creation.. Enabling RDS encryption at the time of instance creation is mandatory for at-rest protection, as this cannot be added to an existing unencrypted instance. Additionally, using AWS KMS customer-managed keys allows the administrator to control the rotation schedule manually or via automatic rotation features, ensuring the underlying cryptographic material is refreshed regularly to maintain compliance and reduce the potential impact of a compromised key.

Answer

Enable RDS encryption using an AWS managed key and configure annual rotation.

Answer

Modify the existing RDS instance to enable encryption after the initial launch.

Answer

Enable Transparent Data Encryption (TDE) via the RDS option group.

Question 14

An organization wants to enforce encryption at rest for all S3 buckets using AWS Organizations. Which TWO actions should the security team perform to ensure consistent governance?

Accepted Answer

Create an SCP that denies s3:PutObject if x-amz-server-side-encryption is not present.. Using Service Control Policies (SCPs) allows for the enforcement of security guardrails across an entire organization. By denying the 'PutObject' operation if encryption headers are missing, and creating an SCP to restrict 'CreateBucket' unless encryption is specified, the organization ensures that all new and existing data remains encrypted. This proactive governance approach prevents developers from accidentally launching non-compliant storage resources, effectively maintaining a secure infrastructure footprint.

Answer

Enable S3 Block Public Access on all accounts via AWS Organizations.

Answer

Use AWS Trusted Advisor to manually audit all buckets for encryption status.

Answer

Apply a bucket policy to every S3 bucket in the account.

Question 15

An organization is using Amazon Macie to protect sensitive data in S3. They want to ensure they are alerted to the presence of PII across all buckets. Which TWO actions are required to configure Macie to identify sensitive data effectively?

Accepted Answer

Create a sensitive data discovery job to scan the S3 buckets, specifying the depth and frequency of the analysis.. Amazon Macie requires both a discovery job and the proper permissions to analyze data. Discovery jobs allow you to define the scope and frequency of the scan, while the service-linked role ensures Macie has the necessary access to read the objects in your S3 buckets for analysis and classification.

Answer

Install the Macie agent on all EC2 instances that write data to the S3 buckets to classify data in real-time.

Answer

Configure S3 Event Notifications to send every new object to a Lambda function that calls the Macie 'ScanObject' API.

Answer

Enable S3 Object Lock on all buckets to allow Macie to generate findings without the risk of data being deleted during a scan.

Question 16

A company is preparing for an annual regulatory audit and needs to collect evidence of their compliance with the SOC 2 framework across multiple AWS accounts. Which TWO AWS services or features should the security team use to automate the collection of evidence and download official compliance reports?

Accepted Answer

AWS Artifact. AWS Audit Manager and AWS Artifact are the primary services for governance and compliance evidence management. Audit Manager automates the process of gathering evidence from various AWS services to assess compliance with frameworks. AWS Artifact provides a central repository for on-demand access to AWS’s own security and compliance reports, which are essential for satisfying external auditors' requirements.

Answer

AWS Security Hub

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 17

A company wants to implement a robust governance framework for their AWS accounts using AWS Control Tower. They need to ensure that specific security guardrails are applied to their 'Financial-Apps' Organizational Unit (OU). Which TWO types of guardrails can be applied within Control Tower?

Accepted Answer

Preventive guardrails using Service Control Policies (SCPs).. AWS Control Tower provides two types of guardrails: preventive and detective. Preventive guardrails are implemented using Service Control Policies (SCPs) to block unauthorized actions. Detective guardrails are implemented using AWS Config rules to monitor and alert on non-compliant resource configurations. Together, they provide a comprehensive governance layer for managing account compliance and security.

Answer

Reactive guardrails using AWS Systems Manager Automation documents.

Answer

Proactive guardrails using IAM Permission Boundaries.

Answer

Administrative guardrails using AWS IAM Identity Center (Succeeded AWS SSO).

Question 18

A company wants to detect potential brute-force attacks against their public-facing web applications hosted on EC2 instances. Which TWO measures should the security team implement?

Accepted Answer

Enable AWS WAF rate-based rules to block IPs exceeding request thresholds.. Implementing a multi-layered defense strategy is essential for detecting and mitigating brute-force attacks. By combining network-level blocking through WAF and host-level monitoring via CloudWatch, organizations can ensure that anomalous patterns are detected in real-time. This proactive detection allows for automated responses, such as modifying security group rules, which significantly reduces the window of opportunity for attackers to successfully compromise sensitive workloads and accounts.

Answer

Use AWS Shield Standard to mitigate Layer 7 application attacks.

Answer

Enable AWS Trusted Advisor to monitor for open security groups.

Answer

Implement AWS Inspector to scan for vulnerabilities on the instances.

Question 19

A company is designing a hub-and-spoke network architecture using AWS Transit Gateway. They want to centralize inbound and outbound internet traffic inspection using a fleet of firewalls in a dedicated 'Security VPC'. Which TWO steps are required to ensure traffic is correctly routed for inspection? (Select TWO.)

Accepted Answer

Enable 'Appliance Mode' on the Transit Gateway VPC attachment for the Security VPC.. In a centralized inspection model, Transit Gateway (TGW) acts as the hub. Traffic from spoke VPCs must be routed to the TGW, which then uses a specific route table to forward traffic to the Security VPC. Appliance Mode must be enabled on the TGW attachment to ensure session stickiness for stateful firewalls.

Answer

Disable 'Source/Destination Check' on all Transit Gateway attachments.

Answer

Use VPC Peering between all spoke VPCs and the Security VPC to bypass the Transit Gateway.

Answer

Create a separate NAT Gateway in every spoke VPC to handle the inspection traffic locally.

Question 20

During a security incident involving suspected data exfiltration from an S3 bucket, which THREE sources provide the most relevant telemetry to determine what files were accessed?

Accepted Answer

CloudTrail Data Events. Determining S3 data access requires combining different logging layers. S3 Server Access Logs provide basic request data, while CloudTrail Data Events provide granular information about specific object-level API calls. VPC Flow Logs are essential if the access was routed through a VPC endpoint. Using these three sources allows the investigator to correlate network traffic with specific identity-based API requests, providing a comprehensive view of the exfiltration activity.

Answer

AWS WAF Logs

Answer

AWS Trusted Advisor reports