How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 14 Refer to the Exhibit Practice Questions scenario questions for the SCS-C03 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SCS-C03 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified Security - Specialty questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise AWS Certified Security - Specialty practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SCS-C03

exam code

Amazon Web Services

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

Refer to the exhibit. The log entry shows a denied 'DeleteTable' attempt. Which service, if configured, would have automatically triggered an alert based on this specific log entry?

Exhibit

2023-10-27T10:00:00Z | User: Admin | Action: DeleteTable | Resource: DynamoDB | Status: Denied

A
Amazon GuardDuty.
Why wrong: GuardDuty is optimized for identifying anomalous patterns like unusual API calls or credential theft, but it does not allow users to define custom metric filters for specific log patterns. It would not specifically alert on a single 'Denied' event unless that event is part of a larger, suspicious behavioral pattern.
B
Amazon CloudWatch Metric Filters and Alarms.
CloudWatch Metric Filters allow users to search CloudTrail logs for specific patterns, such as denied API calls. Once a pattern is matched, a metric can be incremented and an alarm can be configured to notify security personnel, providing an automated way to detect high-risk denied actions.
C
AWS Security Hub.
Why wrong: While Security Hub aggregates findings, it does not act as the primary engine for creating custom alerts based on raw log patterns. To get an alert into Security Hub, the log must first be processed by another service, such as CloudWatch or Lambda, to generate a formal finding.
D
AWS Trusted Advisor.
Why wrong: Trusted Advisor checks for resource optimization and security best practices, but it does not monitor real-time API logs or provide alerting capabilities for specific denied events within an account. It is not designed to function as an incident detection tool for API authorization failures.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

Refer to the exhibit. An incident responder needs to access the production-data bucket to investigate a breach. They apply this policy to their IAM user, but get 'Access Denied' when running 'aws s3 ls s3://production-data'. Why?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::production-data"
    }
  ]
}

A
The user is missing the 's3:GetObject' permission.
Why wrong: The 's3:ListBucket' permission is sufficient for listing the contents of a bucket. The 's3:GetObject' permission is only required if the user attempts to download or read the content of the files themselves, which is not required for the initial 'ls' command to execute successfully.
B
The policy is missing the 'kms:Decrypt' permission for encrypted objects.
If the bucket uses SSE-KMS, the user requires the 'kms:Decrypt' permission on the specific key used to encrypt the data. Without this permission, the S3 service cannot decrypt the bucket metadata required to list the objects, causing the command to fail with an Access Denied error.
C
The resource ARN is incorrectly formatted for S3.
Why wrong: The resource ARN 'arn:aws:s3:::production-data' is the correct format for referencing an S3 bucket in an IAM policy. The list action is bucket-level, and the resource scope is correctly defined for that action, so this does not contribute to the Access Denied error.
D
The user needs the 's3:PutObject' permission to list files.
Why wrong: The 's3:PutObject' permission is strictly for uploading data to a bucket. It is entirely unrelated to the ability to list objects within a bucket. Providing this permission would violate the principle of least privilege and would not resolve the issue preventing the list operation from working.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

Refer to the exhibit. An IAM user with the 'Finance' tag is trying to upload an object to the 'production-data' bucket. The upload is failing. What is the most likely cause?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::production-data/*",
      "Condition": {
        "StringNotEquals": {
          "aws:PrincipalTag/Department": "Finance"
        }
      }
    }
  ]
}

A
The user is missing the required S3 permission in their IAM policy.
Why wrong: While missing permissions might be a cause, the exhibit shows a Deny policy. In AWS, an explicit Deny always overrides any Allow. Even if the user has full S3 permissions, this specific policy will block the action if the condition is met, making policy evaluation order the primary suspect.
B
The user does not have the 'Department' tag attached to their IAM principal.
The Condition uses StringNotEquals. If the tag is missing, the condition evaluates to true for the Deny, because 'null' is not equal to 'Finance'. Therefore, the Deny policy takes effect. ABAC implementations often fail when principals lack the necessary tags required by the policy logic, resulting in unexpected access denial.
C
The S3 bucket policy is not allowing the action.
Why wrong: The exhibit shows an IAM policy, not a bucket policy. While bucket policies can influence access, this specific IAM policy structure is designed to deny access based on principal attributes. The failure is explicitly caused by the logic within this Deny statement, which evaluates to true for non-Finance users.
D
The S3 bucket is in a different AWS region.
Why wrong: S3 bucket location does not affect IAM policy evaluation. IAM policies operate globally and act upon the resource ARN provided in the policy statement. The issue is clearly related to the ABAC logic defined in the condition block, rather than networking or regional constraints associated with the S3 bucket's underlying infrastructure.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

Refer to the exhibit. A security engineer notices that despite the IP restriction, users are still unable to access the S3 bucket from within the corporate network. What is the most likely cause of this issue?

Exhibit

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"*"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::company-data/*","Condition":{"IpAddress":{"aws:SourceIp":"192.168.1.0/24"}}}]}

A
The VPC endpoint for S3 is not configured to allow the corporate IP range.
Why wrong: VPC endpoints are for traffic within AWS infrastructure. If users are accessing the bucket from a corporate office (on-premises), traffic flows over the public internet or Direct Connect. The policy condition 'aws:SourceIp' is the correct mechanism for this scenario, but the syntax error in the policy prevents it from functioning.
B
The 'Action' element is missing from the policy, causing it to be invalid.
The provided JSON is missing the 'Action' key, which is a required component of any IAM policy statement. Without specifying which S3 operations (e.g., s3:GetObject) are allowed, the policy parser will reject the statement, and no access will be granted to any principal attempting to interact with the S3 bucket.
C
The 'aws:SourceIp' condition key is not supported for Amazon S3 bucket policies.
Why wrong: The 'aws:SourceIp' condition key is fully supported in S3 bucket policies for restricting access based on the source IP of the requester. The issue is not the condition key itself, but the overall structure of the JSON policy, which fails to define the permitted actions for the specified principals.
D
The S3 bucket does not have the 'Block Public Access' feature disabled.
Why wrong: While Block Public Access settings can override policies, the primary issue here is the invalid JSON structure. Even if Block Public Access were disabled, the missing 'Action' field ensures the policy cannot be parsed by the IAM engine, making it impossible for the policy to grant any effective permissions to users.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

Refer to the exhibit. This S3 bucket policy is applied to a bucket named 'marketing-data'. What is the effect of this policy regarding access to the objects in the bucket?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::marketing-data/*",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalOrgID": "o-1234567890"
        }
      }
    }
  ]
}

A
It allows any IAM user or role within any account belonging to the AWS Organization 'o-1234567890' to read objects.
The 'aws:PrincipalOrgID' condition key filters the 'Principal: *' to only include identities that are part of the specified AWS Organization. This effectively restricts access to all members of the organization while granting them the 's3:GetObject' permission for the objects in the 'marketing-data' bucket.
B
It makes the bucket public to anyone on the internet as long as they are using an AWS account.
Why wrong: The policy is not public. While 'Principal: *' usually indicates broad access, the 'Condition' block restricts this access to only those principals whose AWS account is a member of the specific organization ID provided. Users from accounts outside this organization will be denied access to the objects.
C
It allows access only if the S3 bucket itself is owned by the organization 'o-1234567890'.
Why wrong: The 'aws:PrincipalOrgID' condition evaluates the organization of the principal (the user or role) making the request, not the organization of the resource owner. While the bucket likely belongs to the same organization, the policy specifically validates the identity of the caller attempting the 's3:GetObject' action.
D
It requires that the request must originate from a VPC endpoint that is tagged with the organization ID.
Why wrong: This policy does not mention VPC endpoints or 'aws:SourceVpce'. It specifically uses the 'aws:PrincipalOrgID' key, which is used to verify the organizational membership of the IAM principal. Tagging of VPC endpoints is a separate mechanism and is not involved in the evaluation of this specific policy condition.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

Refer to the exhibit. Why might a user in the 192.168.1.0/24 range still be denied access to the S3 bucket?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.168.1.0/24"
        }
      }
    }
  ]
}

A
The CIDR range is too small for VPC traffic.
Why wrong: The CIDR range is a valid network notation and has no impact on the technical validity of the IAM policy. The issue is not the size of the range, but rather the overall evaluation logic of IAM policies, which involves multiple layers of potential denials across the environment.
B
An explicit Deny statement exists elsewhere.
In AWS, an explicit 'Deny' always overrides an 'Allow'. Even if this user policy permits access, if a bucket policy or an SCP denies access for that user, the request will be rejected. This hierarchical evaluation is a fundamental part of AWS security governance and complex permission management.
C
The resource ARN is missing the bucket name.
Why wrong: The resource ARN 'arn:aws:s3:::my-bucket/*' is correctly formatted and includes the bucket name. The issue is not the resource pathing, but rather the global permission evaluation logic that applies across different policy types when multiple layers are involved in controlling access to sensitive data.
D
S3 does not support the 'aws:SourceIp' condition.
Why wrong: S3 fully supports the 'aws:SourceIp' condition key. The limitation is not with the service, but with the evaluation hierarchy of policies. The user's inability to access the bucket is likely due to other conflicting policies or missing permissions, not a limitation of the condition key itself.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

Refer to the exhibit. A developer is attempting to upload an object to 'my-secure-bucket' using the AWS CLI but receives an 'Access Denied' error. The developer's command was: 'aws s3 cp file.txt s3://my-secure-bucket/file.txt'. What is the most likely cause of the failure?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-secure-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}

A
The developer does not have the kms:GenerateDataKey permission for the default KMS key used by the bucket.
Why wrong: While the developer might need KMS permissions, the 'Access Denied' in this specific context is triggered by the S3 bucket policy's 'Deny' statement before KMS is even involved. The policy checks for the presence and value of the encryption header in the incoming S3 API request, which is missing in the command.
B
The developer failed to include the '--sse aws:kms' parameter in the CLI command, violating the bucket policy condition.
The bucket policy requires the encryption header to be set to 'aws:kms'. By default, the S3 CLI 'cp' command does not add this header. The developer must explicitly specify the server-side encryption method to satisfy the condition in the bucket policy and avoid the Deny effect.
C
The bucket policy is missing a 'Sid' (Statement ID) which makes the policy invalid and causes S3 to default to a 'Deny' for all requests.
Why wrong: A 'Sid' is an optional field in an IAM or bucket policy and its absence does not make the policy invalid. The policy is syntactically correct as shown. The error is caused by the logic of the 'Deny' statement and the condition, not by a missing optional metadata field in the JSON structure.
D
The 'Resource' ARN in the policy is incorrectly formatted because it uses a wildcard, which is not allowed for s3:PutObject actions.
Why wrong: The resource ARN 'arn:aws:s3:::my-secure-bucket/*' is correctly formatted for object-level actions like s3:PutObject. Wildcards are required here to apply the policy to all objects within the bucket. Without the wildcard, the policy would apply to the bucket itself, which is not appropriate for object upload actions.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

Refer to the exhibit. This GuardDuty finding indicates that malware was detected on an EC2 instance. What is the process GuardDuty used to perform this scan without installing an agent on the instance?

Exhibit

{
  "schemaVersion": "2.0",
  "accountId": "123456789012",
  "region": "us-east-1",
  "partition": "aws",
  "id": "a1b2c3d4e5f6g7h8i9j0",
  "type": "Execution:EC2/MalwareDetected",
  "service": {
    "serviceName": "guardduty",
    "detectorId": "d1e2f3g4h5i6",
    "action": {
      "scanEc2InstanceWithFindingsAction": {
        "ec2InstanceArn": "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef0",
        "scanId": "s-0987654321fedcba0"
      }
    }
  }
}

A
It uses the AWS Systems Manager (SSM) Agent to run a remote anti-virus script on the instance.
Why wrong: GuardDuty Malware Protection does not use the SSM Agent or run any scripts inside the guest operating system. This ensures that the scan does not consume instance resources (CPU/RAM) and cannot be easily detected or tampered with by malware running on the instance.
B
It takes a snapshot of the EBS volume, restores it to a service-owned account, and scans the volume there.
GuardDuty automates the snapshotting and volume creation process in an isolated environment. By scanning a copy of the volume, GuardDuty avoids performance impacts on the production workload and maintains the integrity of the original data while searching for malicious file signatures and patterns.
C
It performs deep packet inspection (DPI) on the VPC traffic to identify malware being downloaded.
Why wrong: While GuardDuty monitors network traffic via VPC Flow Logs, this specific 'MalwareDetected' finding refers to the Malware Protection feature, which scans the file system. Network monitoring detects the 'behavior' of downloading malware, but the scan itself is performed on the disk storage.
D
It uses the GuardDuty Security Agent to perform a memory dump and analyze it for malicious strings.
Why wrong: GuardDuty Malware Protection currently focuses on EBS volume scanning rather than memory analysis. While Runtime Monitoring uses an agent for process activity, the Malware Protection feature is specifically designed to be agentless and operates at the storage level by analyzing disk snapshots.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

Refer to the exhibit. An incident responder observes that an attacker bypassed this S3 bucket policy and accessed objects from an IP address outside the 192.0.2.0/24 range. What is the most likely reason for this access?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-secure-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "192.0.2.0/24"
        }
      }
    }
  ]
}

A
The policy uses 'Allow' instead of 'Deny', allowing bypass by any identity with broad IAM permissions.
Because the policy is an Allow statement, it acts as an additional permission grant rather than a restriction. IAM entities with sufficient permissions elsewhere in the account are not restricted by this policy because it does not contain a Deny rule to supersede those identity-based permissions.
B
The bucket policy must include a Principal element to restrict access to specific identities.
Why wrong: While a Principal element is standard for bucket policies, the issue here relates to the evaluation logic of Allow vs. Deny. Even if a Principal was specified, the lack of an explicit Deny means that other authorized IAM users could still access the bucket outside the provided IP range.
C
The S3 bucket is configured with a public access block that is too permissive.
Why wrong: Public Access Block settings are designed to prevent public access, but they do not override the logic of bucket policies regarding authenticated access. The bypass is caused by the interaction between the resource policy and the identity-based policy, not by the public access block configuration of the bucket.
D
The 'aws:SourceIp' condition does not function for requests made through an AWS service like CloudFront.
Why wrong: While it is true that SourceIp can behave differently with proxies or CloudFront, the fundamental issue is the policy's structure. Regardless of the IP source, the absence of a Deny statement means that any user with existing IAM permissions remains authorized to access the bucket's content.

Full breakdown with real-world context →

Question 10mediummultiple choice

Study the full ACL explanation →

Refer to the exhibit. A user is attempting to connect to a web server from the IP address 203.0.113.5 on port 80. Based on the provided Network ACL and Security Group configurations, what will be the result of this connection attempt?

Exhibit

{
  "NACL_Inbound": [
    {"Rule": 100, "Protocol": "TCP", "Port": 80, "Source": "203.0.113.5/32", "Action": "DENY"},
    {"Rule": 200, "Protocol": "TCP", "Port": 80, "Source": "0.0.0.0/0", "Action": "ALLOW"}
  ],
  "SecurityGroup_Inbound": [
    {"Protocol": "TCP", "Port": 80, "Source": "0.0.0.0/0", "Action": "ALLOW"}
  ]
}

A
The connection will be allowed because the Security Group permits all traffic on port 80.
Why wrong: Security Groups are stateful and allow traffic if a matching rule exists, but they are only evaluated after the stateless Network ACL. Since the NACL has already denied the traffic at the subnet boundary, the Security Group rules are never reached, and the connection attempt is effectively blocked.
B
The connection will be denied because the NACL Rule 100 is evaluated first.
NACLs process rules in order starting from the lowest number. Because Rule 100 matches the source IP and port with a 'DENY' action, the packet is immediately discarded. The higher-numbered 'ALLOW' rule and the permissive Security Group rules are ignored because the first matching NACL rule takes precedence.
C
The connection will be allowed because NACL Rule 200 permits all traffic on port 80.
Why wrong: While Rule 200 is an 'ALLOW' rule for all traffic, NACL rules are not cumulative; the first rule that matches the traffic criteria is applied. Since Rule 100 is a more specific match for the source IP and appears earlier in the sequence, Rule 200 is never applied to this specific connection.
D
The connection will be denied because Security Groups take precedence over NACLs.
Why wrong: This statement is technically incorrect regarding the flow of inbound traffic. In AWS networking, the Network ACL acts as a firewall for the entire subnet and is the first line of defense. Inbound traffic must pass the NACL evaluation before it can reach the Security Group protecting the individual instance.

Full breakdown with real-world context →

Question 11hardmultiple choice

Full question →

Refer to the exhibit. This policy is applied to an Amazon S3 bucket named 'sensitive-data'. What is the security implication of this policy configuration?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": ["arn:aws:s3:::sensitive-data/*"],
    "Condition": {"StringNotEquals": {"aws:SourceVpce": "vpce-1a2b3c4d"}}
  }]
}

A
It allows all users in the VPC to access the bucket if they use the specified VPC endpoint.
Why wrong: An explicit 'Deny' statement does not grant access; it only restricts it. Users still need an explicit 'Allow' statement (either in an IAM policy or elsewhere in the bucket policy) to gain access. This policy simply ensures that even authorized users must use the specific VPC endpoint to connect.
B
It prevents any access to the bucket from outside the specified VPC endpoint.
Because 'Deny' overrides 'Allow' in AWS evaluation logic, this policy effectively blocks all traffic—including from the AWS Management Console or other VPCs—unless it originates from vpce-1a2b3c4d. This is a common pattern for securing highly sensitive data against accidental exposure or credential theft.
C
It only denies access to the bucket if the user is using a different VPC endpoint, but allows public access.
Why wrong: Public access would not originate from the specified VPC endpoint, so it would trigger the 'StringNotEquals' condition and be denied. The policy covers all principals ('*'), meaning it applies to everyone, including anonymous users, effectively preventing any public access to the data stored in the bucket.
D
It restricts access to the bucket to only the root user of the account via the VPC endpoint.
Why wrong: The policy applies to all principals ('*'), not just the root user. While it forces everyone to use the VPC endpoint, it does not distinguish between different IAM users or roles within the account. All identities are subject to the same restriction of having to use the designated endpoint.

Full breakdown with real-world context →

Question 12mediummultiple choice

Full question →

Refer to the exhibit. A security engineer has deployed this AWS WAF rule. If a single IP address sends 1,500 requests in a 5-minute window, what will happen according to this configuration?

Exhibit

{
  "Name": "RateLimitRule",
  "Priority": 1,
  "Action": { "Block": {} },
  "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "RateLimit" },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 1000,
      "AggregateKeyType": "IP"
    }
  }
}

A
All 1,500 requests will be blocked immediately by the WAF.
Why wrong: The first 1,000 requests within the window will be allowed because they have not yet exceeded the threshold. The 'Block' action only applies to subsequent requests that occur once the counter has reached the limit, meaning the initial traffic up to the limit will still reach the application.
B
The first 1,000 requests will be allowed, and the subsequent 500 requests will be blocked.
Rate-limiting works by counting requests over time. Once the IP hits the 1,000-request limit, the WAF begins blocking further requests from that IP. As the 5-minute window slides and older requests age out, the IP may be unblocked if its total count falls back below 1,000.
C
The IP will be added to a permanent blocklist until manually removed by an administrator.
Why wrong: Rate-based rules are dynamic and temporary. There is no manual intervention required to unblock an IP. Once the request rate from that specific IP address drops below the configured limit within the rolling 5-minute period, the WAF automatically stops blocking traffic from that source.
D
The WAF will allow all traffic but send an alert to CloudWatch when the limit is exceeded.
Why wrong: The 'Action' in the exhibit is explicitly set to 'Block', which means the WAF will actively drop the traffic. If the action were set to 'Count', then the traffic would be allowed and a metric would be recorded, but in this specific configuration, the rule is enforcing a hard limit.

Full breakdown with real-world context →

Question 13hardmultiple choice

Full question →

Refer to the exhibit. A developer is attempting to upload a file to 'my-secure-bucket' using the S3 console but receives an Access Denied error. The developer is not specifying any encryption settings during the upload. Based on the provided IAM policy, what is the reason for the failure?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::my-secure-bucket/*"
    },
    {
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-secure-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}

A
The S3 bucket lacks a bucket policy that explicitly allows the PutObject action for the developer.
Why wrong: While a bucket policy can grant access, the IAM policy shown already includes an 'Allow' for all S3 actions. The failure is not due to a lack of permission but rather the presence of an explicit 'Deny' statement that overrides the general 'Allow' when specific conditions are not met.
B
The explicit Deny statement takes precedence because the upload request does not include the required KMS encryption header.
In AWS IAM, an explicit deny always overrides an allow. The policy denies 'PutObject' if the encryption header is not 'aws:kms'. Since the developer did not specify encryption, the condition evaluates to true for the deny statement, resulting in an Access Denied error for the operation.
C
The developer's IAM user does not have the 'kms:GenerateDataKey' permission required to encrypt the object.
Why wrong: The error described is 'Access Denied' from S3 based on the policy evaluation, not a KMS error. While the developer would eventually need KMS permissions to complete the upload with encryption, the immediate failure is caused by the S3 policy condition rejecting the request before KMS is even invoked.
D
The resource ARN in the policy is incorrect because it should include the bucket name without the trailing slash.
Why wrong: The resource 'arn:aws:s3:::my-secure-bucket/*' is correct for object-level operations like 'PutObject'. Removing the trailing slash and asterisk would refer to the bucket itself rather than the objects within it, which is not the issue here as the policy correctly targets the objects for the upload action.

Full breakdown with real-world context →

Question 14hardmultiple choice

Full question →

Refer to the exhibit. An administrator applied this policy to a bucket, but users are still able to upload unencrypted objects. Why is this occurring?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnencryptedTraffic",
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "aws:kms"
        }
      }
    }
  ]
}

A
The policy lacks a wildcard in the resource ARN.
Why wrong: The resource ARN correctly includes '/*' to match all objects within the bucket. The issue is not the scope of the resource but rather the logic of the condition check, which only evaluates the header if it happens to be provided in the request.
B
The condition only checks the header if it exists in the request.
In AWS IAM policy logic, if a header is missing from the request, the 'StringNotEquals' condition does not evaluate to true, so the 'Deny' effect is not applied. The request proceeds as if the condition were not there, allowing unencrypted uploads to bypass the security check.
C
The 'Effect' should be changed to 'Allow'.
Why wrong: Changing the effect to 'Allow' would not enforce encryption; it would simply permit the action. An 'Allow' statement does not provide the restriction required to block non-compliant traffic, as 'Deny' statements are required for robust security guardrails that override any conflicting 'Allow' permissions.
D
The policy needs an 'Action' of 's3:PutObjectTagging'.
Why wrong: Adding tagging permissions does not influence encryption behavior. The 'PutObject' action is the correct focus for controlling object uploads, but the current condition logic is the failure point, as it assumes the header is always present, which is not guaranteed for every incoming S3 request.

Full breakdown with real-world context →

These SCS-C03 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style SCS-C03 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related SCS-C03 topic practice pages

Detection practice questions

Incident Response practice questions

Infrastructure Security practice questions

Identity and Access Management practice questions

Data Protection practice questions

Security Foundations and Governance practice questions

SCS-C03 fundamentals practice questions

SCS-C03 scenario practice questions

SCS-C03 troubleshooting practice questions

Practice scenarios

Refer to the exhibit. The log entry shows a denied 'DeleteTable' attempt. Which service, if configured, would have automatically triggered an alert based on this specific log entry?

Exhibit

Refer to the exhibit. An incident responder needs to access the production-data bucket to investigate a breach. They apply this policy to their IAM user, but get 'Access Denied' when running 'aws s3 ls s3://production-data'. Why?

Exhibit

Refer to the exhibit. An IAM user with the 'Finance' tag is trying to upload an object to the 'production-data' bucket. The upload is failing. What is the most likely cause?

Exhibit

Refer to the exhibit. A security engineer notices that despite the IP restriction, users are still unable to access the S3 bucket from within the corporate network. What is the most likely cause of this issue?

Exhibit

Refer to the exhibit. This S3 bucket policy is applied to a bucket named 'marketing-data'. What is the effect of this policy regarding access to the objects in the bucket?

Exhibit

Refer to the exhibit. Why might a user in the 192.168.1.0/24 range still be denied access to the S3 bucket?

Exhibit

Refer to the exhibit. A developer is attempting to upload an object to 'my-secure-bucket' using the AWS CLI but receives an 'Access Denied' error. The developer's command was: 'aws s3 cp file.txt s3://my-secure-bucket/file.txt'. What is the most likely cause of the failure?

Exhibit

Refer to the exhibit. This GuardDuty finding indicates that malware was detected on an EC2 instance. What is the process GuardDuty used to perform this scan without installing an agent on the instance?

Exhibit

Refer to the exhibit. An incident responder observes that an attacker bypassed this S3 bucket policy and accessed objects from an IP address outside the 192.0.2.0/24 range. What is the most likely reason for this access?

Exhibit

Refer to the exhibit. A user is attempting to connect to a web server from the IP address 203.0.113.5 on port 80. Based on the provided Network ACL and Security Group configurations, what will be the result of this connection attempt?

Exhibit

Refer to the exhibit. This policy is applied to an Amazon S3 bucket named 'sensitive-data'. What is the security implication of this policy configuration?

Exhibit

Refer to the exhibit. A security engineer has deployed this AWS WAF rule. If a single IP address sends 1,500 requests in a 5-minute window, what will happen according to this configuration?

Exhibit

Refer to the exhibit. A developer is attempting to upload a file to 'my-secure-bucket' using the S3 console but receives an Access Denied error. The developer is not specifying any encryption settings during the upload. Based on the provided IAM policy, what is the reason for the failure?

Exhibit

Refer to the exhibit. An administrator applied this policy to a bucket, but users are still able to upload unencrypted objects. Why is this occurring?

Exhibit