SCS-C03 Practice Questions

Question 1

Refer to the exhibit. The log entry shows a denied 'DeleteTable' attempt. Which service, if configured, would have automatically triggered an alert based on this specific log entry?

Accepted Answer

Amazon CloudWatch Metric Filters and Alarms.. This log entry represents an unauthorized attempt to modify critical infrastructure. To alert on this, one must integrate CloudTrail with Amazon CloudWatch Logs and establish a Metric Filter that matches the 'Denied' status and the 'DeleteTable' action. This pattern is essential for incident response, as it allows security teams to distinguish between accidental user error and potential malicious reconnaissance or destructive intent by an insider.

Answer

Amazon GuardDuty.

Answer

AWS Security Hub.

Answer

AWS Trusted Advisor.

Question 2

An organization requires centralized monitoring of security findings from multiple AWS accounts. Which service should be used to aggregate these findings into a single dashboard?

Accepted Answer

AWS Security Hub.. AWS Security Hub acts as a central hub for security posture management. By aggregating findings from GuardDuty, Inspector, IAM Access Analyzer, and third-party partners, it provides a unified view of security threats. This consolidation is critical for large-scale environments, as it allows security teams to prioritize alerts effectively, reduce operational overhead, and ensure consistent compliance monitoring across the entire organization via AWS Organizations integration.

Answer

AWS CloudWatch Dashboards.

Answer

AWS Systems Manager OpsCenter.

Answer

AWS Config Advanced Query.

Question 3

During an investigation into an EC2 instance compromise, a security analyst needs to understand the relationship between different AWS resources, such as which IAM roles were used and which IP addresses interacted with the instance. Which service should the analyst use to perform this graph-based investigation?

Accepted Answer

Amazon Detective. Amazon Detective automatically collects log data from AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked data set. This allows analysts to visualize and investigate the root cause of security findings by exploring the relationships and activities between users, roles, and IP addresses.

Answer

Amazon CloudWatch Logs Insights

Answer

AWS CloudTrail

Answer

AWS Security Hub

Question 4

An organization wants to improve its vulnerability management posture by ensuring that all Amazon EC2 instances are regularly scanned for software vulnerabilities and unintended network exposure. Which TWO features of Amazon Inspector help achieve this?

Accepted Answer

Continuous scanning for software vulnerabilities in installed packages.. Amazon Inspector is an automated vulnerability management service. It continuously scans EC2 instances for software vulnerabilities (using the SSM Agent) and network reachability issues. This dual approach ensures that both internal software flaws and external configuration weaknesses are identified and reported to the security team.

Answer

Automated remediation of insecure Security Group rules.

Answer

Real-time detection of brute-force login attempts.

Answer

Malware scanning for EBS volumes attached to instances.

Question 5

Which AWS service uses machine learning to detect unusual activity, such as unauthorized access to S3 buckets or atypical API calls?

Accepted Answer

AWS GuardDuty.. AWS GuardDuty is an intelligent threat detection service that continuously monitors for malicious or unauthorized behavior. It leverages machine learning to analyze CloudTrail events, VPC Flow Logs, and DNS logs. This is essential for organizations because it identifies threats without requiring the management of complex rule sets, helping teams respond quickly to compromised accounts or malicious instances within the environment.

Answer

AWS Macie.

Answer

AWS WAF.

Answer

AWS CloudTrail.

Question 6

A security team needs to identify which IAM users have not used their credentials for more than 90 days. Which service should be used to provide this information?

Accepted Answer

IAM Credential Report.. IAM credential reports are the standard way to audit account security. They provide a comprehensive, comma-separated file that contains information about all users in the account and the status of their credentials, including password, access keys, and MFA status. This is critical for security hygiene and compliance, as it allows administrators to proactively disable or remove stale accounts, reducing the risk of unauthorized access via forgotten credentials.

Answer

AWS CloudTrail.

Answer

AWS Config.

Answer

AWS Trusted Advisor.

Question 7

A security engineer needs to detect if any EC2 instances in an account have been launched with a public IP address. Which service should be used to automate this detection?

Accepted Answer

AWS Config.. AWS Config is a powerful tool for enforcing compliance with infrastructure policies. By using managed rules like 'ec2-instance-no-public-ip', the engineer can automatically flag any instance that violates the policy. This is a critical detective control for preventing unauthorized network exposure, enabling the team to remediate the violation before a security incident occurs, which is essential for maintaining a hardened, private-by-default cloud environment.

Answer

AWS CloudTrail.

Answer

Amazon GuardDuty.

Answer

AWS Systems Manager.

Question 8

An organization detects unauthorized access to an Amazon S3 bucket containing sensitive customer data. The Security team needs to immediately isolate the bucket while ensuring logs are preserved for forensic analysis. Which action should the team take first?

Accepted Answer

Apply a bucket policy that denies all 's3:*' actions for all users except the security incident response role.. Immediately restricting access via a restrictive bucket policy is the most effective way to stop data exfiltration while keeping the bucket available for investigation. Unlike deleting the bucket, which destroys evidence, a policy change enforces least privilege while maintaining the integrity of the data store for future forensics. This approach aligns with the containment phase of the AWS incident response lifecycle, prioritizing the cessation of malicious activity before proceeding to deeper investigation.

Answer

Delete the S3 bucket to prevent further unauthorized data access.

Answer

Disable AWS CloudTrail logging to stop generating potentially malicious log entries.

Answer

Revoke all IAM user credentials globally to lock down the entire AWS account.

Question 9

A financial institution requires that all CloudTrail logs be stored for seven years for compliance audits. They also need the ability to run complex SQL queries against these logs to identify specific user actions across all regions. What is the most cost-effective and operationally simple solution?

Accepted Answer

Use CloudTrail Lake to create an event data store with a seven-year retention period.. CloudTrail Lake is a managed data lake that simplifies the storage and analysis of CloudTrail events. It eliminates the need to build complex ETL pipelines between S3, Glue, and Athena. It provides a built-in SQL query engine and supports long-term retention policies suitable for compliance requirements.

Answer

Store logs in an S3 bucket and use Amazon Athena to run SQL queries.

Answer

Stream logs to Amazon OpenSearch Service for real-time indexing and visualization.

Answer

Enable CloudWatch Logs for CloudTrail and use Logs Insights for querying.

Question 10

A security team needs to perform deep packet inspection (DPI) on traffic entering and leaving a specific EC2 instance to look for complex attack signatures that VPC Flow Logs cannot detect. Which AWS feature should they use to facilitate this?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring allows you to copy network traffic from an elastic network interface (ENI) of an EC2 instance and send it to a security appliance for inspection. This is essential for deep packet inspection (DPI), as it provides the actual packet payloads, unlike Flow Logs which only provide metadata.

Answer

VPC Flow Logs with custom format fields.

Answer

Amazon GuardDuty Network Monitoring

Answer

AWS Network Firewall with stateless rules.

Question 11

Which THREE of the following resource types are currently supported by IAM Access Analyzer to identify potential public or cross-account access?

Accepted Answer

Amazon S3 Buckets. IAM Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity. It does this by analyzing resource-based policies. This helps security teams identify unintended access to sensitive data or infrastructure and is a critical part of the 'Detection' domain.

Answer

Amazon DynamoDB Tables

Answer

Amazon EC2 Security Groups

Question 12

An organization's security team detects an active data exfiltration event originating from a compromised Amazon EC2 Linux instance. The instance contains critical forensic evidence that must be preserved. What is the most effective immediate containment action that prevents external communication while retaining the memory state for forensic analysis?

Accepted Answer

Modify the security groups attached to the EC2 instance to block all inbound and outbound traffic while keeping the operating system running.. Isolating the compromised instance using a dedicated security group ensures complete network containment while preventing any state loss. Stopping or terminating the instance would wipe volatile RAM memory, permanently destroying crucial artifacts required for deep forensic investigation. Preserving memory is critical for identifying intrusion vectors and achieving root cause analysis compliance during major security incidents.

Answer

Stop the EC2 instance immediately to disconnect it from the network and preserve the attached Amazon EBS root volume for offline examination.

Answer

Terminate the compromised instance and launch a replacement instance from a clean AMI to maintain high availability and service uptime.

Answer

Detach the primary Amazon EBS volume from the running instance and attach it to an isolated analysis instance for live scanning.

Question 13

A security analyst needs to detect potential exfiltration of sensitive data from an S3 bucket that has public access blocked. Which Amazon GuardDuty feature should be configured to detect anomalous data access patterns by internal IAM users?

Accepted Answer

Activate S3 Protection in Amazon GuardDuty.. GuardDuty S3 Protection analyzes CloudTrail S3 data events to detect anomalous activities, such as unusual access patterns or data access from unexpected locations. This feature is essential for identifying compromised identities that attempt to mass-download objects. By focusing on data-level events, it provides visibility into malicious behavior that standard API monitoring might miss, ensuring that even authorized users are monitored for activity that deviates from their historical baseline profile.

Answer

Enable VPC Flow Logs analysis within GuardDuty.

Answer

Configure AWS CloudTrail Insights for the S3 management events.

Answer

Deploy Macie to monitor S3 bucket access logs.

Question 14

An organization is concerned about detecting potential SQL injection attacks against their web application hosted on Application Load Balancer. Which service provides the best native detection capability?

Accepted Answer

AWS WAF with SQL injection rule sets.. AWS WAF provides native inspection of web traffic and can detect common patterns of SQL injection. It is the most effective tool to stop these attacks at the edge, before they reach the backend application. Proper configuration of WAF rules is a critical detective and preventative control, ensuring that malicious payloads are identified and filtered in real-time, which protects application databases from compromise and unauthorized data access.

Answer

Amazon GuardDuty.

Answer

Amazon Inspector.

Answer

AWS CloudTrail.

Question 15

An organization wants to improve their ability to respond to security incidents. Which TWO of the following services provide centralized visibility and management for security findings?

Accepted Answer

AWS Security Hub. AWS Security Hub and Amazon Detective are designed to aggregate, manage, and investigate security data. Security Hub acts as the central pane of glass for findings from various AWS services, while Detective provides the visualization tools needed to investigate the root cause of those findings. Together, they streamline the identification and triage process, allowing responders to move quickly from alert to conclusion during a security incident.

Answer

Amazon CloudWatch

Answer

AWS Artifact

Answer

AWS Systems Manager

AWS Certified Security - Specialty SCS-C03 practice test

Three ways to study

Study SCS-C03 by domain

Study SCS-C03 by topic

Detection practice questions

Incident Response practice questions

Infrastructure Security practice questions

Identity and Access Management practice questions

Data Protection practice questions

Security Foundations and Governance practice questions

SCS-C03 fundamentals practice questions

SCS-C03 scenario practice questions

SCS-C03 troubleshooting practice questions

AWS Certified Security - Specialty practice questions