SCS-C03 Data Protection Practice Question
Which service should be used to protect sensitive data from being exfiltrated via API calls to unauthorized services?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPC Endpoint Policies
VPC endpoints, specifically Interface Endpoints (powered by AWS PrivateLink), allow you to restrict traffic to specific AWS services. By using a VPC Endpoint Policy, you can restrict API calls to only those services you explicitly authorize. This provides a robust preventative control that stops data from being sent to unauthorized accounts or services, even if an identity is compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall that monitors HTTP/HTTPS requests to web applications. It is designed to block malicious web traffic, such as SQL injection or cross-site scripting. It does not provide the capability to control or restrict API calls to AWS services.
- ✓
VPC Endpoint Policies
Why this is correct
VPC Endpoint Policies are attached to VPC endpoints and allow you to define which AWS service actions are permitted. This is a highly effective way to prevent unauthorized data exfiltration by ensuring that only approved AWS services can be accessed from within your VPC.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail is a detective control that logs API activity. It does not provide a mechanism to prevent or block API calls in real-time. While it is essential for auditing and investigating exfiltration after it occurs, it cannot be used to prevent it proactively.
- ✗
AWS Shield
Why it's wrong here
AWS Shield is a managed DDoS protection service. It protects against availability attacks. It does not monitor or control the data content of API requests, nor does it have the capability to restrict communication to specific AWS service endpoints for security policy enforcement.
About these practice questions
Courseiva writes every SCS-C03 question from scratch — 99 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C03 exam.