SCS-C03 Security Foundations and Governance — 10 Questions

Question 1

A security engineer must ensure that all EBS volumes in an account are encrypted by default. How should they achieve this?

Accepted Answer

Enable 'EBS encryption' in the EC2 console settings.. The explanation is correct, but the option text 'Enable 'EBS encryption' in the EC2 console settings' is slightly ambiguous. It should be updated to reflect the specific setting name 'EBS encryption by default'.

Answer

Create an IAM policy that denies ec2:CreateVolume.

Answer

Apply a resource tag to all existing volumes.

Answer

Use AWS Trusted Advisor to delete unencrypted volumes.

Question 2

Which THREE of the following are true regarding the AWS Shared Responsibility Model?

Accepted Answer

AWS is responsible for patching the underlying host operating system.. AWS is responsible for the security OF the cloud (hardware, global infrastructure, and the virtualization layer). Customers are responsible for security IN the cloud, which includes guest operating system patching, IAM policy configuration, data encryption, and network traffic protection (Security Groups/NACLs).

Answer

AWS is responsible for configuring the customer's IAM policies.

Answer

Customers are responsible for physical security of AWS data centers.

Question 3

An organization wants to use AWS Organizations to manage security across 50 accounts. What is the recommended strategy for delegating security tasks?

Accepted Answer

Create a dedicated Security account and delegate services.. AWS Organizations allows for the delegation of specific services to member accounts. By assigning a member account as the 'Delegated Administrator' for services like Security Hub, GuardDuty, or IAM Access Analyzer, the organization can centralize security operations without granting administrative access to the management account itself. This adheres to the principle of least privilege and reduces the risk associated with having a single highly-privileged account for all daily management tasks.

Answer

Use the management account for all security administration.

Answer

Grant IAM full access to all security teams in each account.

Answer

Enable SCPs for all users in every account.

Question 4

Refer to the exhibit. A developer created this policy to troubleshoot S3 issues. Why is this a major security governance violation?

Accepted Answer

It violates the principle of least privilege.. The explanation correctly identifies that the use of 's3:*' on 'Resource: *' violates the principle of least privilege. The reasoning is sound and aligns with AWS security best practices.

Answer

It lacks a condition block for MFA.

Answer

It requires the 'Action' to be in a list format.

Answer

It does not specify a Region.

Question 5

Which TWO of the following are core components of a robust AWS Governance program?

Accepted Answer

Service Control Policies (SCPs). Governance in AWS is achieved through a combination of preventative guardrails and detective controls. Service Control Policies (SCPs) act as the foundation for preventing non-compliant actions at the organizational level, while AWS Config ensures continuous monitoring and detection of configuration changes that drift from the security baseline. Together, these tools provide a comprehensive framework that enforces adherence to organizational policies while maintaining visibility into the current state of the infrastructure.

Answer

Manual code reviews for every API call.

Answer

Deleting all IAM users and using only root.

Answer

Disabling all logs to save costs.

Question 6

An auditor needs to verify that the organization's S3 buckets are not publicly accessible. What is the most efficient way to achieve this at scale?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer for S3 provides a centralized dashboard to identify buckets that are shared with external entities or are publicly accessible. It is the most efficient tool for auditing at scale. While S3 Block Public Access (Option D) prevents public access, it is a configuration setting, not an auditing/verification tool.

Answer

Manual inspection of every bucket policy.

Answer

AWS CloudTrail log analysis.

Answer

Enable S3 Block Public Access.

Question 7

Refer to the exhibit. A developer is attempting to upload an object to the 'company-data' bucket using the AWS CLI but is receiving an 'Access Denied' error. The developer is not specifying any encryption headers in the command. Based on the provided IAM policy, what is the reason for this failure?

Accepted Answer

The explicit Deny statement overrides the Allow statement because the encryption condition was not met during the request.. The explanation claims the condition triggers if the header is not 'AES256'. However, standard S3 bucket policies for enforcing encryption typically use 's3:x-amz-server-side-encryption' with 'aws:kms' or 'AES256'. If the policy uses 'StringNotEquals' for 'AES256', the explanation is technically correct, but the logic provided in the explanation is slightly ambiguous regarding the specific condition operator. Furthermore, the explanation mentions 'AES256' while the stem implies a generic encryption requirement. The logic is sound, but the explanation needs to be precise about the condition operator (e.g., StringNotEquals).

Answer

The policy requires the use of AWS KMS (SSE-KMS) for all uploads, and the developer used the default S3 managed keys.

Answer

The resource specified in the Allow statement is for objects only, but the Deny statement applies to the entire bucket.

Answer

The developer lacks the s3:ListBucket permission, which is required to perform a PutObject operation via the CLI.

Question 8

A security architect is designing a multi-account security posture using AWS Security Hub. The goal is to aggregate findings from all accounts into a central security account and automate the response to high-severity findings. Which THREE steps are required to achieve this architecture?

Accepted Answer

Designate a security account as the delegated administrator for Security Hub via AWS Organizations.. To aggregate findings in Security Hub, you must designate a delegated administrator and enable cross-region aggregation. Option B is incorrect because Security Hub uses a native multi-account architecture via AWS Organizations, not manual cross-account IAM roles. Option E is incorrect because AWS Config aggregators are for configuration data, not Security Hub findings. The correct steps are A, C, and D.

Answer

Configure a cross-account IAM role in every member account for the security account to pull findings.

Answer

Deploy an AWS Config aggregator in the management account to collect Security Hub findings.

Question 9

A company needs to implement a tagging policy across its AWS Organization to ensure all Amazon EC2 instances have a 'CostCenter' tag. If the tag is missing or incorrect, the resource creation should be allowed, but the non-compliance must be visible centrally. Which solution meets these governance requirements?

Accepted Answer

Enable Tag Policies in AWS Organizations and define the 'CostCenter' tag requirement.. Tag Policies define the tagging standards, but they do not provide the 'central visibility' of non-compliance on their own. To achieve central visibility, the Tag Policy must be used in conjunction with AWS Config (specifically the 'Tag Policies' compliance dashboard or AWS Config rules). However, as a standalone governance tool for standardization and reporting, Tag Policies are the correct architectural choice compared to the other options.

Answer

Use an SCP to deny ec2:RunInstances if the 'CostCenter' tag is not present in the request.

Answer

Create an AWS Config rule in every account to check for the 'CostCenter' tag on EC2 instances.

Answer

Implement a Lambda function that runs on a schedule to scan all accounts and tag resources.

Question 10

Which TWO security-related checks are performed by AWS Trusted Advisor for all AWS customers, regardless of their support plan?

Accepted Answer

Amazon S3 Bucket Permissions. AWS Trusted Advisor provides a set of core checks available to all customers, which include 'S3 Bucket Permissions', 'Security Groups - Specific Ports Unrestricted', 'IAM Use', and 'MFA on Root Account'. The distinction between support plans (Basic/Developer vs. Business/Enterprise) applies to the full suite of checks, but the four mentioned are all part of the core set available to all tiers.

Answer

Amazon EBS Public Snapshots