SCS-C03 Question Bank · Latest 50 Questions Free Preview (Page 1/5)
Questions 1–10 of the latest 50 SCS-C03 questions (5 pages total), with answers and explanations, no login required. Practice all 76 questions online.
Question 1 · No. 25 · Single choice
A company maintains both on-premises legacy systems and resources in AWS. The AWS resources include an Amazon DynamoDB table and an Amazon S3 bucket. The on-premises legacy systems need to connect to DynamoDB and Amazon S3 on a regular basis. The company currently uses a bastion host in a public subnet in a VPC. The company connects to the bastion host by using an SSH private key that the company stores on-premises. The instance profile that is assigned to the bastion host has full access to Amazon S3 and DynamoDB. A security team issues a new internal policy that requires all bastion hosts to be removed. The policy requires all systems to authenticate by using certificate-based authentication. Which solution will meet these requirements?
- A. Set up an AWS Direct Connect connection and create a VPN connection to a VPC that has access to VPC endpoints for the required services.
- B. Set up the on-premises systems to use AWS IAM Roles Anywhere to authenticate.
- C. Use AWS Private Certificate Authority to issue SSL certificates to give on-premises systems access to resources on AWS.
- D. Create an IAM user that has permission to temporarily assume an IAM role and to use temporarily assumed role credentials to access the required resources.
Answer: B
Explanation: AWS IAM Roles Anywhere allows on-premises workloads (servers, containers, etc.) to obtain temporary AWS credentials using X.509 digital certificates for authentication. This directly addresses both requirements: 1) it removes the need for a bastion host by enabling direct, secure access from on-premises systems to AWS resources (S3 and DynamoDB), and 2) it enforces certificate-based authentication as required by the new security policy. Option A provides network connectivity but doesn't solve certificate-based authentication. Option C issues SSL certificates but doesn't directly provide AWS resource access credentials. Option D uses IAM users with access keys, not certificates, and doesn't address the bastion host removal properly.
Question 2 · No. 26 · Single choice
A company is planning to deploy a new log analysis environment. The company needs to implement a solution to analyze logs from multiple AWS services in near real time. The solution must provide the ability to search the logs. The solution also must send alerts to an existing Amazon Simple Notification Service (Amazon SNS) topic when specific logs match detection rules. Which solution will meet these requirements?
- A. Analyze the logs by using Amazon OpenSearch Service. Search the logs from the OpenSearch API. Use OpenSearch Service Security Analytics to match logs with detection rules and to send alerts to the SNS topic.
- B. Analyze the logs by using AWS Security Hub. Search the logs from the Findings page in Security Hub. Create custom actions to match logs with detection rules and to send alerts to the SNS topic.
- C. Analyze the logs by using Amazon CloudWatch Logs. Use a subscription filter to match logs with detection rules and to send alerts to the SNS topic. Search the logs manually by using CloudWatch Logs Insights.
- D. Analyze the logs by using Amazon QuickSight. Search the logs by listing the query results in a dashboard. Run queries to match logs with detection rules and to send alerts to the SNS topic
Answer: A
Question 3 · No. 27 · Single choice
A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off. What is the MOST efficient way to implement this solution?
- A. Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.
- B. Create an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging API.
- C. Create an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLogging event name to invoke an AWS Lambda function to call the StartLogging API.
- D. Monitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.
Answer: A
Question 4 · No. 28 · Multiple choice
An ecommerce website was down for 1 hour following a DDoS attack. Users were unable to connect to the website during the attack period. The ecommerce company's security team is worried about future potential attacks and wants to prepare for such events. The company needs to minimize downtime in its response to similar attacks in the future. Which steps would help achieve this? (Choose two.)
- A. Enable Amazon GuardDuty to automatically monitor for malicious activity and block unauthorized access.
- B. Subscribe to AWS Shield Advanced and reach out to AWS Support in the event of an attack.
- C. Use VPC Flow Logs to monitor network traffic and an AWS Lambda function to automatically block an attacker's IP using security groups.
- D. Set up an Amazon EventBridge rule to monitor the AWS CloudTrail events in real time, use AWS Config rules to audit the configuration, and use AWS Systems Manager for remediation.
- E. Use AWS WAF to create rules to respond to such attacks.
Answer: B, E
Explanation: For DDoS attack mitigation, the best solutions are: (B) AWS Shield Advanced - this is AWS's premium DDoS protection service specifically designed to protect applications from DDoS attacks, providing enhanced protection, real-time visibility, and 24/7 access to AWS Support team during attacks; (E) AWS WAF - this web application firewall allows creation of custom rules to filter and block malicious traffic patterns associated with DDoS attacks, and integrates well with CloudFront and ALB. Options A (GuardDuty) is for threat detection but doesn't actively block attacks. Option D is more about general security monitoring and remediation, not specifically for DDoS. Option C using VPC Flow Logs has inherent delays making it unsuitable for real-time DDoS mitigation.
Question 5 · No. 29 · Single choice
A company runs an application on an Amazon EC2 instance. The application generates invoices and stores them in an Amazon S3 bucket. The instance profile that is attached to the instance has appropriate access to the S3 bucket. The company needs to share each invoice with multiple clients that do not have AWS credentials. Each client must be able to download only the client's own invoices. Clients must download their invoices within 1 hour of invoice creation. Clients must use only temporary credentials to access the company’s AWS resources. A security engineer creates a script that runs on the EC2 instance. The script uses the instance profile to generate an S3 presigned URL for the clients. Each presigned URL expires after 1 hour. Which additional step will meet these requirements?
- A. Update the S3 bucket policy to ensure that clients that use presigned URLs have the S3:Get* permission and the S3:List* permission to access S3 objects in the bucket.
- B. Add a StringEquals condition to the IAM role policy for the EC2 instance profile. Configure the policy condition to restrict access based on the s3:ResourceTag/ClientId tag of each invoice. Tag each generated invoice with the ID of its corresponding client.
- C. Update the script to use AWS Security Token Service (AWS STS) to obtain new credentials each time the script runs by assuming a new role that has S3 GetObject permissions. Use the credentials to generate the presigned URLs.
- D. Generate an access key and a secret key for an IAM user that has S3:GetObject permissions on the S3 bucket. Embed the keys into the script. Use the keys to generate the presigned URLs.
Answer: C
Explanation: Option C is the correct answer because it explicitly uses AWS STS to assume a new role with minimal S3:GetObject permissions, generating fresh temporary credentials each time the script runs. This meets all requirements: (1) each client can only download their own invoices (presigned URLs are object-specific), (2) downloads happen within 1 hour (URL expiration), and (3) only temporary credentials are used (STS-issued credentials). Option A is incorrect because it grants overly broad permissions (S3:Get* and S3:List*) without restricting clients to their own invoices, violating least privilege. Option B is problematic because tag-based IAM policy conditions don't apply effectively to presigned URLs since the URLs already authorize access to specific objects, adding unnecessary complexity. Option D violates the requirement for temporary credentials by embedding long-term IAM user access keys in the script, which is a security anti-pattern.
Question 6 · No. 30 · Single choice
A company has two AWS accounts: Account A and Account B. Each account has a VPC. An application that runs in the VPC in Account A needs to write to an Amazon S3 bucket in Account B. The application in Account A already has permission to write to the S3 bucket in Account B. The application and the S3 bucket are in the same AWS Region. The company cannot send network traffic over the public internet. Which solution will meet these requirements?
- A. In both accounts, create a transit gateway and VPC attachments in a subnet in each Availability Zone. Update the VPC route tables.
- B. Deploy a software VPN appliance in Account A. Create a VPN connection between the software VPN appliance and a virtual private gateway in Account B.
- C. Create a VPC peering connection between the VPC in Account A and the VPC in Account B. Update the VPC route tables, network ACLs, and security groups to allow network traffic between the peered IP ranges.
- D. In Account A, create a gateway VPC endpoint for Amazon S3. Update the VPC route table in Account A.
Answer: D
Explanation: Option D is correct because a Gateway VPC Endpoint for Amazon S3 provides private connectivity between a VPC and Amazon S3 without traversing the public internet. Even though the S3 bucket is in Account B, a Gateway VPC Endpoint in Account A can route traffic to S3 through AWS's private network. Since the application in Account A already has the necessary IAM permissions to write to the S3 bucket in Account B (as stated in the question), creating the Gateway VPC Endpoint in Account A and updating its route table will meet all the requirements: same Region, no public internet traffic, and successful cross-account S3 access. Options A, B, and C involve connecting VPCs to each other (via transit gateway, VPN, or VPC peering), but S3 is not a VPC resource, so these solutions do not address the need for private connectivity to S3.
Question 7 · No. 31 · Single choice
A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards. However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes.
Which solution will meet this requirement in the MOST operationally efficient way?
- A. Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
- B. Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes.
- C. Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
- D. Use AWS Cloud Map to detect the configuration changes. Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.
Answer: B
Explanation: AWS Config is the appropriate service for this use case because it is specifically designed to continuously monitor and record AWS resource configurations. It maintains a detailed history of configuration changes and always reflects the latest configuration state of resources. When multiple changes occur in quick succession, AWS Config records the most recent state, which captures the cumulative impact of all the changes. This is exactly what the security engineer needs to evaluate compliance standards. Option A (CloudTrail) only logs API calls and does not aggregate configuration states. Option C (CloudWatch) is used for metrics and logs monitoring, not configuration tracking. Option D (AWS Cloud Map) is a service discovery tool, not a configuration compliance tool.
Question 8 · No. 32 · Single choice
A company has installed a third-party application that is distributed on several Amazon EC2 instances and on-premises servers. Occasionally, the company's IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection.
Which solution will meet these requirements?
- A. Create a bastion host with port forwarding to connect to the machines.
- B. Set up AWS Systems Manager Session Manager to allow temporary connections.
- C. Use AWS CloudShell to create serverless connections.
- D. Set up an interface VPC endpoint for each machine for private connection.
Answer: B
Explanation: AWS Systems Manager Session Manager is the correct solution because it provides secure, audited SSH-like access to both EC2 instances and on-premises servers without requiring SSH keys (using IAM authentication instead). It supports temporary connections and only incurs charges during active sessions, meeting the pay-per-use requirement. Additionally, with Session Manager, machines don't need to expose inbound SSH ports or public IPs—the SSM Agent initiates outbound connections, which satisfies the network isolation requirement. Option A (bastion host) requires SSH keys and runs continuously. Option C (CloudShell) is for AWS resource management, not SSH access to instances. Option D (VPC endpoints) provides private access to AWS services, not SSH connectivity to specific machines.
Question 9 · No. 33 · Single choice
A security engineer recently rotated the host keys for an Amazon EC2 instance. The security engineer is trying to access the EC2 instance by using the EC2 Instance Connect feature. However, the security engineer receives an error for failed host key validation. Before the rotation of the host keys, EC2 Instance Connect worked correctly with this EC2 instance.
What should the security engineer do lo resolve this error?
- A. Import the key material into AWS Key Management Service (AWS KMS).
- B. Manually upload the new host key to the AWS trusted host keys database
- C. Ensure that the AmazonSSMManagedInstanceCore policy is attached to the EC2 instance profile.
- D. Create a new SSH key pair for the EC2 instance.
Answer: B
Explanation: When host keys are rotated on an EC2 instance, EC2 Instance Connect's host key validation will fail because it still has the old host key in its trusted host keys database. EC2 Instance Connect uses this database to verify the identity of the EC2 instance and prevent man-in-the-middle attacks. After rotating the host keys, the security engineer must manually upload the new host key to the AWS trusted host keys database so that EC2 Instance Connect can validate the new host key. Option A is unrelated to host key validation; Option C deals with SSM permissions, not EC2 Instance Connect host key validation; Option D addresses user SSH keys (authentication), not host keys (server identification).
Question 10 · No. 34 · Single choice
A company is operating an open-source software platform that is internet facing. The legacy software platform no longer receives security updates. The software platform operates using Amazon Route 53 weighted load balancing to send traffic to two Amazon EC2 instances that connect to an Amazon RDS cluster. A recent report suggests this software platform is vulnerable to SQL injection attacks, with samples of attacks provided. The company’s security engineer must secure this system against SQL injection attacks within 24 hours. The security engineer’s solution must involve the least amount of effort and maintain normal operations during implementation.
What should the security engineer do to meet these requirements?
- A. Create an Application Load Balancer with the existing EC2 instances as a target group. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the ALB. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to the ALB. Update security groups on the EC2 instances to prevent direct access from the internet.
- B. Create an Amazon CloudFront distribution specifying one EC2 instance as an origin. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the distribution. Test to ensure the vulnerability has been mitigated, then redirect the Route 53 records to point to CloudFront.
- C. Obtain the latest source code for the platform and make the necessary updates. Test the updated code to ensure that the vulnerability has been mitigated, then deploy the patched version of the platform to the EC2 instances.
- D. Update the security group that is attached to the EC2 instances, removing access from the internet to the TCP port used by the SQL database. Create an AWS WAF web ACL containing rules that protect the application from this attack, then apply it to the EC2 instances. Test to ensure the vulnerability has been mitigated, then restore the security group to the original setting.
Answer: A
Explanation: Option A is the best solution because it addresses the SQL injection vulnerability with minimal effort and without modifying the legacy code. By creating an Application Load Balancer (ALB) in front of the existing EC2 instances and attaching an AWS WAF web ACL with SQL injection protection rules, the security engineer can filter malicious traffic before it reaches the application. Updating the security groups to prevent direct internet access to the EC2 instances ensures traffic must flow through the ALB (and thus the WAF), preventing attackers from bypassing the protection. This approach can be implemented quickly within 24 hours, requires no code changes to the legacy platform, and maintains normal operations. Option B fails because it only uses one EC2 instance as the CloudFront origin, losing the load balancing between the two instances. Option C requires significant effort to modify legacy code within 24 hours and the legacy platform no longer receives security updates so the latest code may still be vulnerable. Option D is technically incorrect because AWS WAF cannot be applied directly to EC2 instances, and the security group change would break normal operations.