SCS-C03 Question Bank · Latest 50 Questions Free Preview (Page 2/5)
Questions 11–20 of the latest 50 SCS-C03 questions (5 pages total), with answers and explanations, no login required. Practice all 76 questions online.
Question 11 · No. 35 · Single choice
A company has a web-based application that runs behind an Application Load Balancer (ALB). The application is experiencing a credential stuffing attack that is producing many failed login attempts. The attack is coming from many IP addresses. The login attempts are using a user agent string of a known mobile device emulator.
A security engineer needs to implement a solution to mitigate the credential stuffing attack. The solution must still allow legitimate logins to the application.
Which solution will meet these requirements?
- A. Create an Amazon CloudWatch alarm that reacts to login attempts that contain the specified user agent string Add an Amazon Simple Notification Service (Amazon SNS) topic to the alarm.
- B. Modify the inbound security group on the ALB to deny traffic from the IP addresses that are involved in the attack.
- C. Create an AWS WAF web ACL for the ALB Create a custom rule that blocks requests that contain the user agent string of the device emulator.
- D. Create an AWS WAF web ACL for the ALB. Create a custom rule that allows requests from legitimate user agent strings.
Answer: C
Explanation: The best solution is to create an AWS WAF web ACL for the ALB with a custom rule that blocks requests containing the user agent string of the device emulator. Option A only provides monitoring and notifications but does not actually block the attack. Option B is impractical because the attack is coming from many IP addresses, and security groups cannot easily filter by user agent strings. Option D uses an allowlist approach, which is too restrictive because it would require knowing all legitimate user agent strings and could block legitimate users. Option C is the most effective because AWS WAF operates at the application layer and can filter based on user agent strings, directly blocking the credential stuffing attack while still allowing legitimate logins from real devices with different user agent strings.
Question 12 · No. 36 · Multiple choice
A security engineer discovers that a company’s user passwords have no required minimum length. The company is using the following two identity providers (IdPs):
AWS Identity and Access Management (IAM) federated with on-premises Active Directory
Amazon Cognito user pools that contain the user database for an AWS Cloud application that the company developed
Which combination of actions should the security engineer take to implement a required minimum length for the passwords? (Choose two.)
- A. Update the password length policy in the IAM configuration.
- B. Update the password length policy in the Cognito configuration.
- C. Update the password length policy in the on-premises Active Directory configuration
- D. Create an SCP in AWS Organizations. Configure the SCP to enforce a minimum password length for IAM and Cognito.
- E. Create an IAM policy that includes a condition for minimum password length. Enforce the policy for IAM and Cognito.
Answer: B, C
Explanation: The correct answers are B and C. For Amazon Cognito user pools, you can directly configure a password policy that includes minimum length requirements, so updating the Cognito configuration is appropriate (B). For AWS IAM federated with on-premises Active Directory, the password policy for federated users is managed in the source identity provider, which is the on-premises Active Directory. Therefore, updating the password length policy in the on-premises Active Directory configuration will enforce the minimum length for users authenticating through IAM federation (C). Option A is incorrect because IAM's password policy does not apply to federated users - their passwords are managed by the external IdP (Active Directory). Option D is incorrect because SCPs (Service Control Policies) are used to manage the maximum permissions available to accounts in AWS Organizations; they cannot enforce password length policies. Option E is incorrect because IAM policies control permissions/actions, not password characteristics like length - IAM policy conditions cannot enforce minimum password length.
Question 13 · No. 37 · Single choice
A company has hundreds of AWS accounts in an organization in AWS Organizations. The company operates out of a single AWS Region. The company has a dedicated security tooling AWS account in the organization. The security tooling account is configured as the organization's delegated administrator for Amazon GuardDuty and AWS Security Hub. The company has configured the environment to automatically enable GuardDuty and Security Hub for existing AWS accounts and new AWS accounts.
The company is performing control tests on specific GuardDuty findings to make sure that the company's security team can detect and respond to security events. The security team launched an Amazon EC2 instance and attempted to run DNS requests against a test domain, example.com, to generate a DNS finding. However, the GuardDuty finding was never created in the Security Hub delegated administrator account.
Why was the finding was not created in the Security Hub delegated administrator account?
- A. VPC flow logs were not turned on for the VPC where the EC2 instance was launched.
- B. The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver.
- C. The GuardDuty integration with Security Hub was never activated in the AWS account where the finding was generated.
- D. Cross-Region aggregation in Security Hub was not configured.
Answer: B
Explanation: The correct answer is B. GuardDuty generates DNS findings by monitoring DNS query logs for the VPC's default DNS resolver (AmazonProvidedDNS at 169.254.169.253). When the DHCP options set for a VPC are configured to use a custom DNS resolver like OpenDNS, all DNS queries from EC2 instances in that VPC are directed to the external OpenDNS resolver instead of the AWS-provided resolver. Since GuardDuty cannot inspect DNS traffic going to external resolvers, it never detects the DNS activity, and therefore no DNS finding is generated. Since the finding was never created in GuardDuty in the first place, it would not appear in the Security Hub delegated administrator account, regardless of integration settings. Option A is incorrect because VPC flow logs are not required for GuardDuty DNS findings. Option C is incorrect because the finding itself was never generated by GuardDuty. Option D is incorrect because the company operates in a single AWS Region, so cross-Region aggregation is not relevant.
Question 14 · No. 38 · Single choice
A company wants to store all objects that contain sensitive data in an Amazon S3 bucket. The company will use server-side encryption to encrypt the S3 bucket. The company’s operations team manages access to the company’s S3 buckets. The company’s security team manages access to encryption keys.
The company wants to separate the duties of the two teams to ensure that configuration errors by only one of these teams will not compromise the data by granting unauthorized access to plaintext data.
Which solution will meet this requirement?
- A. Ensure that the operations team configures default bucket encryption on the S3 bucket to use server-side encryption with Amazon S3 managed encryption keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to use the encryption keys.
- B. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with AWS KMS keys (SSE-KMS) that are customer managed. Ensure that the security team creates a key policy that controls access to the encryption keys.
- C. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with Amazon S3 managed keys (SSE-S3). Ensure that the security team creates an IAM policy that controls access to the encryption keys.
- D. Ensure that the operations team creates a bucket policy that requires requests to use server-side encryption with customer-provided encryption keys (SSE-C). Ensure that the security team stores the customer-provided keys in AWS Key Management Service (AWS KMS). Ensure that the security team creates a key policy that controls access to the encryption keys.
Answer: B
Explanation: Option B is the correct answer because it properly separates duties between the operations team and the security team. The operations team manages the bucket policy that requires SSE-KMS (server-side encryption with AWS KMS keys) using customer managed keys, which controls access to the S3 bucket. The security team creates a key policy that controls access to the encryption keys in AWS KMS. This separation ensures that a configuration error by only one team will not compromise the data: if the operations team makes an error, users may have bucket access but won't have access to the encryption keys; if the security team makes an error, they may have access to the keys but won't have access to the bucket. Options A and C use SSE-S3 which uses Amazon S3 managed keys, so the security team cannot manage the keys themselves. Option D incorrectly suggests storing SSE-C keys in AWS KMS, but SSE-C requires customers to provide keys with each request, not store them in KMS.
Question 15 · No. 39 · Single choice
A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company’s primary website. The GuardDuty finding received read:
UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.
The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor.
What is the first step the security engineer should take?
- A. Open the EC2 console and remove any security groups that allow inbound traffic from 0.0.0.0/0.
- B. Install the AWS Systems Manager Agent on the EC2 instance and run an inventory report.
- C. Install the Amazon Inspector agent on the host and run an assessment with the CVE rules package.
- D. Open the IAM console and revoke all IAM sessions that are associated with the instance profile.
Answer: D
Explanation: The first step is to revoke all IAM sessions associated with the instance profile. Since the malicious actor exfiltrated API access keys tied to the EC2 instance's instance profile, the immediate priority is to terminate those active sessions to prevent further unauthorized access. The other options either don't address the credential-based access (A is about network rules, B is about systems management, C is about vulnerability assessment) or are not immediate containment steps. Revoking IAM sessions is the fastest way to deny access to the attacker using the stolen credentials.
Question 16 · No. 40 · Multiple choice
A corporate cloud security policy slates that communications between the company's VPC and KMS must travel entirely within the AWS network and not use public service endpoints.
Which combination of the following actions MOST satisfies this requirement? (Choose two.)
- A. Add the aws:sourceVpce condition to the AWS KMS key policy referencing the company’s VPC endpoint ID.
- B. Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.
- C. Create a VPC endpoint for AWS KMS with private DNS enabled.
- D. Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.
- E. Add the following condition to the AWS KMS key policy: "aws:SourceIp": "10.0.0.0/16".
Answer: A, C
Explanation: Option A is correct because adding the aws:sourceVpce condition to the KMS key policy ensures that only requests originating from the specified VPC endpoint can access the KMS key, effectively preventing access via public endpoints. Option C is correct because creating a VPC endpoint for AWS KMS with private DNS enabled establishes a private connection within the AWS network, ensuring that all traffic between the VPC and KMS stays within AWS infrastructure rather than traversing the public internet. Together, these two actions satisfy the requirement of keeping communications within the AWS network. Options B, D, and E do not adequately address the requirement: B uses a virtual private gateway for VPN rather than VPC endpoints for AWS service connectivity; D's Import Key feature is about key material import, not network path control; and E uses IP-based conditions which do not specifically enforce the use of private VPC endpoints over public service endpoints.
Question 17 · No. 41 · Single choice
A company is using Amazon Elastic Container Service (Amazon ECS) to deploy an application that deals with sensitive data. During a recent security audit, the company identified a security issue in which Amazon RDS credentials wore stored with the application code in the company's source code repository.
A security engineer needs to develop a solution to ensure that database credentials are stored securely and rotated periodically. The credentials should be accessible to the application only. The engineer also needs to prevent database administrators from sharing database credentials as plaintext with other teammates. The solution must also minimize administrative overhead.
Which solution meets these requirements?
- A. Use the AWS Systems Manager Parameter Store to generate database credentials. Use an IAM profile for ECS tasks to restrict access to database credentials to specific containers only.
- B. Use AWS Secrets Manager to store database credentials. Use an IAM inline policy for ECS tasks to restrict access to database credentials to specific containers only.
- C. Use the AWS Systems Manager Parameter Store to store database credentials. Use IAM roles for ECS tasks to restrict access to database credentials to specific containers only.
- D. Use AWS Secrets Manager to store database credentials. Use IAM roles for ECS tasks to restrict access to database credentials to specific containers only.
Answer: D
Explanation: Option D is the best choice because AWS Secrets Manager provides built-in automatic rotation for RDS credentials, which satisfies the requirement for periodic credential rotation without requiring custom Lambda functions (minimizing administrative overhead). Additionally, using IAM roles for ECS tasks is the recommended and standard approach for granting permissions to containers, allowing fine-grained access control so credentials are accessible only to the application. Parameter Store does not offer built-in rotation (unlike Secrets Manager), and IAM profiles/inline policies are not the preferred method for ECS tasks compared to IAM roles.
Question 18 · No. 42 · Single choice
A company sands Amazon RDS snapshots to two accounts as part of its disaster recovery (DR) plan. The snapshots must be encrypted. However, each account needs to be able to decrypt the snapshots in case of a DR event.
Which solution will meet these requirements?
- A. Use the default AWS Key Management Sen/ice (AWS KMS) key to generate the snapshots. Create an AWS Lambda function that copies the KMS encryption key to the two accounts.
- B. Use an AWS Key Management Service (AWS KMS) customer managed key to generate the snapshots. Create an AWS Lambda function that imports the KMS key in the two accounts.
- C. Use the default AWS Key Management Service (AWS KMS) key to generate the snapshots. Share the KMS key with the two accounts by using an IAM principal that has the proper KMS permissions in each account.
- D. Use an AWS Key Management Service (AWS KMS) customer managed key to generate the snapshots. Share the KMS key with the two accounts by using an IAM principal that has the proper KMS permissions in each account.
Answer: D
Explanation: The correct solution is to use a customer managed key and share it across accounts via IAM principals with proper permissions. AWS KMS customer managed keys support cross-account access through key policies and IAM permissions, allowing multiple accounts to use the same key for encryption and decryption. The default AWS KMS key (AWS-managed key) cannot be shared across accounts, and KMS keys cannot be copied or imported between accounts using Lambda functions. By creating a customer managed key and configuring appropriate IAM policies, both accounts can decrypt the snapshots during a DR event.
Question 19 · No. 43 · Multiple choice
A company recently set up Amazon GuardDuty and is receiving a high number of findings from IP addresses within the company. A security engineer has verified that these IP addresses are trusted and allowed.
Which combination of steps should the security engineer take to configure GuardDuty so that it does not produce findings for these IP addresses? (Choose two.)
- A. Create a plaintext configuration file that contains the trusted IP addresses.
- B. Create a JSON configuration file that contains the trusted IP addresses.
- C. Upload the configuration file directly to GuardDuty.
- D. Upload the configuration file to Amazon S3. Add a new trusted IP list to GuardDuty that points to the file.
- E. Manually copy and paste the configuration file data into the trusted IP list in GuardDuty.
Answer: A, D
Question 20 · No. 44 · Single choice
A company runs workloads in an AWS account. A security engineer observes some unusual findings in Amazon GuardDuty. The security engineer wants to investigate a specific IAM role and generate an investigation report. The report must contain details about anomalous behavior and any indicators of compromise.
Which solution will meet these requirements?
- A. Use Amazon Detective to perform an investigation on the IAM role.
- B. Use AWS Audit Manager to create an assessment. Specify the IAM role Run an assessment report.
- C. Use Amazon Inspector to create an assessment. Specify the IAM role. Run an assessment report.
- D. Use Amazon Inspector to run an on-demand scan of the IAM role.
Answer: A
Explanation: Amazon Detective is specifically designed to help security engineers analyze, investigate, and identify the root cause of security findings, including unusual GuardDuty findings. It automatically collects logs and data from AWS resources to build a unified, interactive view that can be used to analyze anomalies and identify indicators of compromise for specific entities such as IAM roles. AWS Audit Manager is focused on compliance audits, while Amazon Inspector is used for vulnerability and security configuration assessments of applications and infrastructure—not for investigating anomalous behavior or indicators of compromise related to IAM roles.