SCS-C03 Security Foundations and Governance — 25 Questions

Question 1

A security engineer must ensure that all EBS volumes in an account are encrypted by default. How should they achieve this?

Accepted Answer

Enable 'EBS encryption' in the EC2 console settings.. The explanation is correct, but the option text 'Enable 'EBS encryption' in the EC2 console settings' is slightly ambiguous. It should be updated to reflect the specific setting name 'EBS encryption by default'.

Answer

Create an IAM policy that denies ec2:CreateVolume.

Answer

Apply a resource tag to all existing volumes.

Answer

Use AWS Trusted Advisor to delete unencrypted volumes.

Question 2

Which THREE of the following are true regarding the AWS Shared Responsibility Model?

Accepted Answer

AWS is responsible for patching the underlying host operating system.. AWS is responsible for the security OF the cloud (hardware, global infrastructure, and the virtualization layer). Customers are responsible for security IN the cloud, which includes guest operating system patching, IAM policy configuration, data encryption, and network traffic protection (Security Groups/NACLs).

Answer

AWS is responsible for configuring the customer's IAM policies.

Answer

Customers are responsible for physical security of AWS data centers.

Question 3

An organization wants to use AWS Organizations to manage security across 50 accounts. What is the recommended strategy for delegating security tasks?

Accepted Answer

Create a dedicated Security account and delegate services.. AWS Organizations allows for the delegation of specific services to member accounts. By assigning a member account as the 'Delegated Administrator' for services like Security Hub, GuardDuty, or IAM Access Analyzer, the organization can centralize security operations without granting administrative access to the management account itself. This adheres to the principle of least privilege and reduces the risk associated with having a single highly-privileged account for all daily management tasks.

Answer

Use the management account for all security administration.

Answer

Grant IAM full access to all security teams in each account.

Answer

Enable SCPs for all users in every account.

Question 4

Refer to the exhibit. A developer created this policy to troubleshoot S3 issues. Why is this a major security governance violation?

Accepted Answer

It violates the principle of least privilege.. The explanation correctly identifies that the use of 's3:*' on 'Resource: *' violates the principle of least privilege. The reasoning is sound and aligns with AWS security best practices.

Answer

It lacks a condition block for MFA.

Answer

It requires the 'Action' to be in a list format.

Answer

It does not specify a Region.

Question 5

Which TWO of the following are core components of a robust AWS Governance program?

Accepted Answer

Service Control Policies (SCPs). Governance in AWS is achieved through a combination of preventative guardrails and detective controls. Service Control Policies (SCPs) act as the foundation for preventing non-compliant actions at the organizational level, while AWS Config ensures continuous monitoring and detection of configuration changes that drift from the security baseline. Together, these tools provide a comprehensive framework that enforces adherence to organizational policies while maintaining visibility into the current state of the infrastructure.

Answer

Manual code reviews for every API call.

Answer

Deleting all IAM users and using only root.

Answer

Disabling all logs to save costs.

Question 6

An auditor needs to verify that the organization's S3 buckets are not publicly accessible. What is the most efficient way to achieve this at scale?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer for S3 provides a centralized dashboard to identify buckets that are shared with external entities or are publicly accessible. It is the most efficient tool for auditing at scale. While S3 Block Public Access (Option D) prevents public access, it is a configuration setting, not an auditing/verification tool.

Answer

Manual inspection of every bucket policy.

Answer

AWS CloudTrail log analysis.

Answer

Enable S3 Block Public Access.

Question 7

Refer to the exhibit. A developer is attempting to upload an object to the 'company-data' bucket using the AWS CLI but is receiving an 'Access Denied' error. The developer is not specifying any encryption headers in the command. Based on the provided IAM policy, what is the reason for this failure?

Accepted Answer

The explicit Deny statement overrides the Allow statement because the encryption condition was not met during the request.. The explanation claims the condition triggers if the header is not 'AES256'. However, standard S3 bucket policies for enforcing encryption typically use 's3:x-amz-server-side-encryption' with 'aws:kms' or 'AES256'. If the policy uses 'StringNotEquals' for 'AES256', the explanation is technically correct, but the logic provided in the explanation is slightly ambiguous regarding the specific condition operator. Furthermore, the explanation mentions 'AES256' while the stem implies a generic encryption requirement. The logic is sound, but the explanation needs to be precise about the condition operator (e.g., StringNotEquals).

Answer

The policy requires the use of AWS KMS (SSE-KMS) for all uploads, and the developer used the default S3 managed keys.

Answer

The resource specified in the Allow statement is for objects only, but the Deny statement applies to the entire bucket.

Answer

The developer lacks the s3:ListBucket permission, which is required to perform a PutObject operation via the CLI.

Question 8

A security architect is designing a multi-account security posture using AWS Security Hub. The goal is to aggregate findings from all accounts into a central security account and automate the response to high-severity findings. Which THREE steps are required to achieve this architecture?

Accepted Answer

Designate a security account as the delegated administrator for Security Hub via AWS Organizations.. To aggregate findings in Security Hub, you must designate a delegated administrator and enable cross-region aggregation. Option B is incorrect because Security Hub uses a native multi-account architecture via AWS Organizations, not manual cross-account IAM roles. Option E is incorrect because AWS Config aggregators are for configuration data, not Security Hub findings. The correct steps are A, C, and D.

Answer

Configure a cross-account IAM role in every member account for the security account to pull findings.

Answer

Deploy an AWS Config aggregator in the management account to collect Security Hub findings.

Question 9

A company needs to implement a tagging policy across its AWS Organization to ensure all Amazon EC2 instances have a 'CostCenter' tag. If the tag is missing or incorrect, the resource creation should be allowed, but the non-compliance must be visible centrally. Which solution meets these governance requirements?

Accepted Answer

Enable Tag Policies in AWS Organizations and define the 'CostCenter' tag requirement.. Tag Policies define the tagging standards, but they do not provide the 'central visibility' of non-compliance on their own. To achieve central visibility, the Tag Policy must be used in conjunction with AWS Config (specifically the 'Tag Policies' compliance dashboard or AWS Config rules). However, as a standalone governance tool for standardization and reporting, Tag Policies are the correct architectural choice compared to the other options.

Answer

Use an SCP to deny ec2:RunInstances if the 'CostCenter' tag is not present in the request.

Answer

Create an AWS Config rule in every account to check for the 'CostCenter' tag on EC2 instances.

Answer

Implement a Lambda function that runs on a schedule to scan all accounts and tag resources.

Question 10

Which TWO security-related checks are performed by AWS Trusted Advisor for all AWS customers, regardless of their support plan?

Accepted Answer

Amazon S3 Bucket Permissions. AWS Trusted Advisor provides a set of core checks available to all customers, which include 'S3 Bucket Permissions', 'Security Groups - Specific Ports Unrestricted', 'IAM Use', and 'MFA on Root Account'. The distinction between support plans (Basic/Developer vs. Business/Enterprise) applies to the full suite of checks, but the four mentioned are all part of the core set available to all tiers.

Answer

Amazon EBS Public Snapshots

Question 11

Refer to the exhibit. This Service Control Policy (SCP) is applied to the 'Production' Organizational Unit (OU). A developer in a member account within this OU is trying to create an Amazon CloudFront distribution, which is a global service. What will be the result of this action?

Accepted Answer

The action will fail because the request to the global endpoint does not match the 'us-east-1' region requirement.. Global services like CloudFront do not have a region in the request context. When an SCP uses 'StringNotEquals' with 'aws:RequestedRegion', the condition evaluates to true for global services because the region key is missing (null). Therefore, the Deny effect is triggered. The explanation should clarify that global services lack a region attribute, causing the condition to match and deny the request.

Answer

The action will succeed because CloudFront is a global service and is not bound by regional SCP restrictions.

Answer

The action will succeed because the 'us-east-1' region is the default home for all global service metadata.

Answer

The action will fail because the SCP lacks a 'NotAction' statement to permit global service operations.

Question 12

A company is using AWS Resource Access Manager (RAM) to share a Transit Gateway across multiple accounts in an AWS Organization. The security team needs to ensure that member accounts can use the Transit Gateway but cannot share it further with accounts outside of the organization. How can this be enforced?

Accepted Answer

Disable the 'Allow sharing with anyone' option in the AWS RAM settings in the management account.. AWS RAM has a setting in the management account called 'Allow sharing with anyone' (or 'Allow sharing with external accounts'). When this setting is enabled, accounts within the organization can potentially share resources with accounts outside the organization. Disabling this setting ensures that all resource shares are restricted strictly to the AWS Organization, satisfying the security requirement without overly restricting member accounts from using the Transit Gateway.

Answer

Attach a resource-based policy to the Transit Gateway that explicitly denies access to non-org principals.

Answer

Use an SCP to deny the ram:CreateResourceShare action for all member accounts.

Answer

Configure a VPC Endpoint for RAM and restrict access using a VPC Endpoint policy.

Question 13

An organization is using AWS Organizations with all features enabled. They want to prevent any account, including the management account, from being able to leave the organization. Which governance action should be taken?

Accepted Answer

Apply an SCP to the Root of the organization that denies the 'organizations:LeaveOrganization' action.. To prevent an AWS account from leaving an organization, you use Service Control Policies (SCPs) denying the 'organizations:LeaveOrganization' action. However, SCPs do not apply to the management account. The management account cannot leave the organization because it is the entity that created it; an organization cannot exist without a management account.

Answer

There is no way to prevent the management account from leaving, but member accounts are locked in automatically.

Answer

Enable 'Account Lockdown' in the AWS Organizations settings console.

Answer

Ensure that the organization was created in 'Consolidated Billing' mode only.

Question 14

A security auditor requires a centralized view of security findings across all AWS accounts in an organization. Which service should be enabled to aggregate and prioritize these findings?

Accepted Answer

AWS Security Hub. AWS Security Hub serves as the central hub for security posture management. By enabling Security Hub in the management account and configuring it to aggregate data from member accounts, auditors gain a unified dashboard. This is essential for maintaining governance and compliance at scale, as it correlates findings from GuardDuty, Inspector, and IAM Access Analyzer into a single actionable view, significantly reducing the operational overhead of manual account-by-account reviews.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

AWS IAM Access Analyzer

Question 15

An organization wants to enforce encryption at rest for all S3 buckets using AWS Organizations. Which TWO actions should the security team perform to ensure consistent governance?

Accepted Answer

Create an SCP that denies s3:PutObject if x-amz-server-side-encryption is not present.. Using Service Control Policies (SCPs) allows for the enforcement of security guardrails across an entire organization. By denying the 'PutObject' operation if encryption headers are missing, and creating an SCP to restrict 'CreateBucket' unless encryption is specified, the organization ensures that all new and existing data remains encrypted. This proactive governance approach prevents developers from accidentally launching non-compliant storage resources, effectively maintaining a secure infrastructure footprint.

Answer

Enable S3 Block Public Access on all accounts via AWS Organizations.

Answer

Use AWS Trusted Advisor to manually audit all buckets for encryption status.

Answer

Apply a bucket policy to every S3 bucket in the account.

Question 16

Refer to the exhibit. An administrator applied this policy to a bucket, but users are still able to upload unencrypted objects. Why is this occurring?

Accepted Answer

The condition only checks the header if it exists in the request.. The policy uses the 's3:x-amz-server-side-encryption' condition key, which is only present if the client specifically sends that header. If a user performs a standard 'PutObject' without the encryption header, the request does not match the condition, and the 'Deny' effect is not triggered. To fix this, the policy must explicitly deny requests where the header is absent, ensuring that all uploads are forced to include mandatory encryption headers.

Answer

The policy lacks a wildcard in the resource ARN.

Answer

The 'Effect' should be changed to 'Allow'.

Answer

The policy needs an 'Action' of 's3:PutObjectTagging'.

Question 17

Which AWS service is best suited for providing a comprehensive, searchable audit trail of every API call made in an AWS account?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the definitive service for tracking user activity and API usage. By recording events as log files, it provides an immutable history of actions taken by users, roles, or services. This is a foundational governance requirement, as it allows security teams to reconstruct events during investigations, verify identity actions, and comply with regulatory requirements regarding data access and infrastructure modifications.

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Answer

AWS Systems Manager

Question 18

A company requires that all cloud resources be tagged with a 'Department' code for cost allocation and security reporting. How should they enforce this?

Accepted Answer

Use AWS Config rules to monitor tagging compliance.. AWS Config is the primary tool for auditing and ensuring resource compliance. By defining a custom or managed Config rule that checks for the existence of the 'Department' tag on resources, the organization can receive alerts when non-compliant resources are created. This ensures visibility into the state of the infrastructure and allows for timely remediation of tagging errors, supporting both financial governance and security-focused asset management.

Answer

Use AWS Budgets to force tagging.

Answer

Use an IAM policy to prevent resource creation.

Answer

Use AWS Trusted Advisor to tag resources.

Question 19

Which AWS IAM best practice ensures that users have only the permissions necessary to perform their specific business roles?

Accepted Answer

Apply the Principle of Least Privilege.. The 'Principle of Least Privilege' is the foundational concept in security governance. By ensuring that identities are granted the minimum level of access required to complete their tasks, organizations significantly reduce the blast radius if an account is compromised. This strategy prevents lateral movement and unauthorized data access, creating a much more resilient environment where security controls are proportional to the user's operational needs.

Answer

Assign the 'AdministratorAccess' policy to all users.

Answer

Use only root account credentials for all tasks.

Answer

Allow all traffic in Security Groups.

Question 20

Refer to the exhibit. Why might a user in the 192.168.1.0/24 range still be denied access to the S3 bucket?

Accepted Answer

An explicit Deny statement exists elsewhere.. IAM policy logic follows the principle of implicit deny. If there is an explicit 'Deny' statement anywhere in the policy evaluation (including the bucket policy or an SCP) that contradicts this 'Allow', access will be denied. Additionally, if the user does not have the 's3:ListBucket' permission, they might be unable to navigate the bucket, even if they can retrieve a specific object when provided with the direct key path.

Answer

The CIDR range is too small for VPC traffic.

Answer

The resource ARN is missing the bucket name.

Answer

S3 does not support the 'aws:SourceIp' condition.