SCS-C03 Question Bank · Latest 50 Questions Free Preview (Page 4/5)

Questions 31–40 of the latest 50 SCS-C03 questions (5 pages total), with answers and explanations, no login required. Practice all 76 questions online.

Question 31 · No. 55 · Multiple choice

A company uses Amazon API Gateway to present REST APIs to users. An API developer wants to analyze API access patterns without the need to parse the log files. Which combination of steps will meet these requirements with the LEAST effort? (Choose two.)

A. Configure access logging for the required API stage.
B. Configure an AWS CloudTrail trail destination for API Gateway events. Configure filters on the userIdentity, userAgent, and sourceIPAddress fields.
C. Configure an Amazon S3 destination for API Gateway logs. Run Amazon Athena queries to analyze API access information.
D. Use Amazon CloudWatch Logs Insights to analyze API access information.
E. Select the Enable Detailed CloudWatch Metrics option on the required API stage.

Answer: A, D

Explanation: To analyze API access patterns with the LEAST effort without parsing log files: Option A configures access logging for the API stage, which is necessary to capture the API access data. Option D uses Amazon CloudWatch Logs Insights to query and analyze the logs directly without needing to parse them. CloudWatch Logs Insights provides a query language that allows developers to extract insights from logs easily. Option B involves CloudTrail which is more complex and primarily tracks management events. Option C requires setting up S3 and Athena queries which is more effort. Option E provides metrics, not detailed access patterns for analysis.

Question 32 · No. 56 · Single choice

A company is investigating an increase in its AWS monthly bill. The company discovers that bad actors compromised some Amazon EC2 instances and served webpages for a large email phishing campaign. A security engineer must implement a solution to monitor for cost increases in the future to help detect malicious activity. Which solution will offer the company the EARLIEST detection of cost increases?

A. Create an Amazon EventBridge rule that invokes an AWS Lambda function hourly. Program the Lambda function to download an AWS usage report from AWS Data Exports about usage of all services. Program the Lambda function to analyze the report and to send a notification when anomalies are detected.
B. Create a cost monitor in AWS Cost Anomaly Detection. Configure an individual alert to notify an Amazon Simple Notification Service (Amazon SNS) topic when the percentage above the expected cost exceeds a threshold.
C. Review AWS Cost Explorer daily to detect anomalies in cost from prior months. Review the usage of any services that experience a significant cost increase from prior months.
D. Capture VPC flow logs from the VPC where the EC2 instances run. Use a third-party network analysis tool to analyze the flow logs and to detect anomalies in network traffic that might increase cost.

Answer: B

Explanation: Option B (AWS Cost Anomaly Detection) provides the earliest detection of cost increases because it uses machine learning to continuously monitor spending and can detect anomalies as they occur, sending notifications immediately when thresholds are exceeded. Option A has latency due to hourly Lambda execution and report analysis. Option C requires daily manual review, which is the slowest. Option D monitors network traffic rather than costs directly and would only detect the cause after the fact. Cost Anomaly Detection is specifically designed for proactive, real-time cost monitoring.

Question 33 · No. 57 · Single choice

A company has multiple accounts in the AWS Cloud. Users in the developer account need to have access to specific resources in the production account. What is the MOST secure way to provide this access?

A. Create one IAM user in the production account Grant the appropriate permissions to the resources that are needed. Share the password only with the users that need access.
B. Create cross-account access with an IAM role in the developer account. Grant the appropriate permissions to this role. Allow users in the developer account to assume this role to access the production resources.
C. Create cross-account access with an IAM user account in the production account. Grant the appropriate permissions to this user account. Allow users in the developer account to use this user account to access the production resources.
D. Create cross-account access with an IAM role in the production account. Grant the appropriate permissions to this rote Allow users in the developer account to assume this role to access the production resources.

Answer: D

Explanation: The MOST secure way to provide cross-account access in AWS is to create an IAM role in the account that owns the resources (the production account), grant the appropriate permissions to that role, and then allow users in the other account (the developer account) to assume that role. This approach follows the principle of least privilege, eliminates the need to share credentials/passwords, and provides centralized access control and auditing through AWS CloudTrail. Option A shares passwords which is insecure. Option B places the role in the wrong account (developer account instead of production account). Option C incorrectly uses an IAM user instead of an IAM role for cross-account access.

Question 34 · No. 58 · Single choice

A company has a platform that is divided into 12 AWS accounts under the same organization in AWS Organizations. Many of these accounts use Amazon API Gateway to expose APIs to the company's frontend applications. The company needs to protect the ousting APIs and any resources that will be deployed in the future against common SQL injection and bot attacks. Which solution will meet these requirements with the LEAST operational overhead?

A. Create an AWS WAF web ACL for each API. Include managed rules to block SQL injection and bot attacks. Use AWS Config to detect new resources that do not have a web ACL. Configure a remediation action to provision a web ACL for these resources.
B. Use AWS Firewall Manager to create an AWS WAF policy. Configure the policy to include the AWS Bot Control and SQL database managed rule groups. Set the policy scope to include the API Gateway stage as the resource type.
C. Create an AWS Service Catalog product for an AWS WAF web ACL that includes rules to block SQL injection and bot attacks. Use AWS Config to detect new resources that do not have this product applied. Configure a remediation action to provision a web ACL for these resources.
D. Use AWS Security Hub to detect unprotected resources and to send the findings as custom action events to Amazon EventBridge. Create an AWS Lambda function for these events to provision an AWS WAF web ACL for the unprotected resources. Include managed rules to block SQL injection and bot attacks.

Answer: B

Explanation: AWS Firewall Manager is the centralized service specifically designed to manage AWS WAF rules across multiple accounts in an AWS Organization. It can automatically apply WAF policies to existing and new resources, including API Gateway stages, with minimal operational overhead. The other options (A, C, D) require manual creation of individual web ACLs, custom remediation logic via Lambda, or use of Service Catalog—all of which involve more operational complexity. Option B leverages Firewall Manager's built-in automation and centralized management to protect APIs against SQL injection and bot attacks with the least overhead.

Question 35 · No. 59 · Single choice

A security engineer needs to implement a solution to identify any sensitive data that is stored in an Amazon S3 bucket. The solution must report on sensitive data in the S3 bucket by using an existing Amazon Simple Notification Service (Amazon SNS) topic. Which solution will meet these requirements with the LEAST implementation effort?

A. Enable AWS Config. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.
B. Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern. Program the Lambda function to send notifications to the SNS topic.
C. Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data. Create an Amazon EventBridge rule to send notifications to the SNS topic.
D. Enable Amazon GuardDuty. Configure AWS CloudTrail S3 data events. Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic.

Answer: C

Explanation: Amazon Macie is the least-effort solution because it uses managed data identifiers to automatically discover and categorize sensitive data in Amazon S3. An EventBridge rule can then forward Macie findings to the existing Amazon SNS topic. AWS Config does not inspect S3 object contents, GuardDuty detects threats rather than identifying sensitive data, and a Lambda function would require custom development and maintenance.

Question 36 · No. 60 · Single choice

A public subnet contains two Amazon EC2 instances. The subnet has a custom network ACL. A security engineer is designing a solution to improve the subnet security. The solution must allow outbound traffic to an internet service that uses TLS through port 443. The solution also must deny inbound traffic that is destined for MySQL port 3306. Which network ACL rule set meets these requirements?

A. Use inbound rule 100 to allow traffic on TCP port 443. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
B. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port range 1024-65535. Use outbound rule 100 to allow traffic on TCP port 443.
C. Use inbound rule 100 to allow traffic on TCP port range 1024-65535. Use inbound rule 200 to deny traffic on TCP port 3306. Use outbound rule 100 to allow traffic on TCP port 443.
D. Use inbound rule 100 to deny traffic on TCP port 3306. Use inbound rule 200 to allow traffic on TCP port 443. Use outbound rule 100 to allow traffic on TCP port 443.

Answer: B

Explanation: Option B is correct. NACLs evaluate rules in ascending order, so the deny rule for MySQL port 3306 (rule 100) must come before any allow rule that might cover that port. Since ephemeral ports (1024-65535) include port 3306, the deny rule must be evaluated first. Option B: Rule 100 denies TCP 3306 (blocks MySQL traffic), Rule 200 allows TCP 1024-65535 (allows return traffic for outbound connections - NACLs are stateless), and Outbound rule 100 allows TCP 443 (allows TLS outbound traffic). Option A fails because it doesn't allow return traffic on ephemeral ports for outbound connections. Option C fails because rule 100 (allowing 1024-65535) would be evaluated before rule 200 (denying 3306), so MySQL traffic would be allowed. Option D fails because it doesn't allow return traffic on ephemeral ports.

Question 37 · No. 61 · Single choice

A company is running an application on Amazon EC2 instances in an Auto Scaling group. The application stores logs locally. A security engineer noticed that logs were lost after a scale-in event. The security engineer needs to recommend a solution to ensure the durability and availability of log data. All logs must be kept for a minimum of 1 year for auditing purposes. What should the security engineer recommend?

A. Within the Auto Scaling lifecycle, add a hook to create and attach an Amazon Elastic Block Store (Amazon EBS) log volume each time an EC2 instance is created. When the instance is terminated, the EBS volume can be reattached to another instance for log review.
B. Create an Amazon Elastic File System (Amazon EFS) file system and add a command in the user data section of the Auto Scaling launch template to mount the EFS file system during EC2 instance creation. Configure a process on the instance to copy the logs once a day from an instance Amazon Elastic Block Store (Amazon EBS) volume to a directory in the EFS file system.
C. Add an Amazon CloudWatch agent into the AMI used in the Auto Scaling group. Configure the CloudWatch agent to send the logs to Amazon CloudWatch Logs for review.
D. Within the Auto Scaling lifecycle, add a lifecycle hook at the terminating state transition and alert the engineering team by using a lifecycle notification to Amazon Simple Notification Service (Amazon SNS). Configure the hook to remain in the Terminating:Wait state for 1 hour to allow manual review of the security logs prior to instance termination.

Answer: C

Explanation: Option C is the best solution because the Amazon CloudWatch agent can be configured to send logs from EC2 instances to Amazon CloudWatch Logs in real-time. CloudWatch Logs provides durable, highly available storage for log data, and allows you to configure retention policies for up to 10 years, which easily meets the 1-year retention requirement. Even when EC2 instances are terminated due to scale-in events, the logs remain available in CloudWatch Logs. Option A is problematic because EBS volumes are tied to specific instances and the volume would be deleted when the instance is terminated by default. Option B involves daily copying, which means logs could be lost (up to a day's worth) before they are copied to EFS. Option D only delays termination for 1 hour but does not actually preserve the logs durably.

Question 38 · No. 62 · Single choice

A security engineer needs to implement a solution to create and control the keys that a company uses for cryptographic operations. The security engineer must create symmetric keys in which the key material is generated and used within a custom key store that is backed by an AWS CloudHSM cluster. The security engineer will use symmetric and asymmetric data key pairs for local use within applications. The security engineer also must audit the use of the keys. How can the security engineer meet these requirements?

A. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon Athena.
B. To create the keys, use Amazon S3 and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.
C. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use Amazon GuardDuty.
D. To create the keys, use AWS Key Management Service (AWS KMS) and the custom key stores with the CloudHSM cluster. For auditing, use AWS CloudTrail.

Answer: D

Explanation: The correct approach is to use AWS Key Management Service (AWS KMS) with custom key stores backed by AWS CloudHSM cluster for creating and managing cryptographic keys. AWS KMS supports custom key stores that allow key material to be generated and used within a CloudHSM cluster, meeting the requirement for creating symmetric keys. For auditing, AWS CloudTrail is the appropriate service as it logs all API calls made to AWS KMS, including key usage, allowing the security engineer to audit the use of keys. Options A and C incorrectly use Amazon Athena (a query service) and Amazon GuardDuty (a threat detection service) for auditing, which are not suitable for KMS key usage auditing. Option B incorrectly suggests using Amazon S3 for key creation, which is not a key management service.

Question 39 · No. 63 · Single choice

A company needs a solution to protect critical data from being permanently deleted. The data is stored in Amazon S3 buckets. The company needs to replicate the S3 objects from the company's primary AWS Region to a secondary Region to meet disaster recovery requirements. The company must also ensure that users who have administrator access cannot permanently delete the data in the secondary Region. Which solution will meet these requirements?

A. Configure AWS Backup to perform cross-Region S3 backups. Select a backup vault in the secondary Region. Enable AWS Backup Vault Lock in governance mode for the backups in the secondary Region.
B. Implement S3 Object Lock in compliance mode in the primary Region. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region.
C. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Create an S3 bucket policy to deny the s3:ReplicateDelete action on the S3 bucket in the secondary Region.
D. Configure S3 replication to replicate the objects to an S3 bucket in the secondary Region. Configure S3 object versioning on the S3 bucket in the secondary Region.

Answer: B

Explanation: S3 Object Lock in compliance mode is the only solution that prevents any user, including administrators and even the root user, from permanently deleting objects during the retention period. When combined with S3 replication, this ensures that the replicated data in the secondary Region is also protected from permanent deletion. Option A uses governance mode, which still allows users with sufficient permissions to delete backups. Option C's s3:ReplicateDelete only prevents delete operations from replicating from primary to secondary, but does not prevent direct deletion in the secondary bucket. Option D's versioning alone does not prevent deletion, as all versions can still be deleted.

Question 40 · No. 64 · Single choice

A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS). The company needs a solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating system, networking, and file events. The solution must send email alerts for any identified risks to a mailing list that is associated with a security team. Which solution will meet these requirements?

A. Deploy AWS Security Hub and enable security standards that contain EKS controls. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailiing list as a subscriber. Use an Amazon EventBridge rule to send relevant Security Hub events to the SNS topic.
B. Enable Amazon Inspector container image scanning. Configure Amazon Detective to analyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Use an AWS Lambda function to process the logs and to send email alerts to the security team.
C. Enable Amazon GuardDuty Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
D. Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. Configure Amazon CloudWatch Logs lo collect EKS audit logs. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team's mailing list as a subscriber. Configure a CloudWatch alarm to publish a message to the SNS topic when now audit logs are generated.

Answer: C

Explanation: Option C is the best solution because Amazon GuardDuty with EKS Protection and Runtime Monitoring covers all the requirements: (1) GuardDuty EKS Protection analyzes EKS audit logs to detect security risks, (2) GuardDuty Runtime Monitoring analyzes operating system, networking, and file events for threats, and (3) the SNS topic with EventBridge rule integration provides a standard way to send email alerts to the security team's mailing list. Option A (Security Hub) doesn't directly monitor OS, networking, and file events. Option B uses Inspector (image scanning only) and Detective (analysis tool, not detection). Option D uses SSM Agent inappropriately and CloudWatch alarm would trigger on all logs rather than specific risks.

Prev 1 2 345 Next