SCS-C03 Question Bank · Latest 50 Questions Free Preview (Page 5/5)
Questions 41–50 of the latest 50 SCS-C03 questions (5 pages total), with answers and explanations, no login required. Practice all 76 questions online.
Question 41 · No. 65 · Single choice
What is the effect of the following AWS Key Management Service (AWS KMS} key policy that is attached to a customer managed key?
<img title="image14" src="https://img.examtopics.com/aws-certified-security-specialty-scs-c03/image14.png">
- A. Amazon WorkMail and Amazon Simple Email Service (Amazon SES) have delegated KMS encrypt and decrypt permissions to the ExampleRole principal in the 111122223333 account.
- B. The ExampleRole principal can transparently encrypt and decrypt email exchanges specifically between ExampleRole and AWS.
- C. The customer managed key can be used for encrypting and decrypting only when the principal is ExampleRole and when the request comes from Amazon WorkMail or Amazon Simple Email Service (Amazon SES) in the specified AWS Region.
- D. The key policy allows Amazon WorkMail or Amazon Simple Email Service (Amazon SES) to encrypt or decrypt on behalf of the ExampleRole for any customer managed key in the account.
Answer: C
Explanation: The KMS key policy shown specifies conditions that restrict key usage to specific AWS services (Amazon WorkMail and Amazon SES), a specific principal (ExampleRole), and a specific AWS Region. Option C correctly describes this behavior - the customer managed key can only be used for encrypting and decrypting when the principal is ExampleRole AND when the request comes from Amazon WorkMail or Amazon SES in the specified AWS Region. Option A is incorrect because the services don't delegate permissions to ExampleRole; rather, ExampleRole uses the key through these services. Option B incorrectly mentions 'transparent' encryption, which is not how KMS works. Option D is incorrect because the policy restricts usage to specific services in a specific region, not 'any customer managed key in the account'.
Question 42 · No. 66 · Single choice
A company recently experienced a malicious attack on its cloud-based environment. The company successfully contained and eradicated the attack A security engineer is performing incident response work. The security engineer needs to recover an Amazon RDS database cluster to the last known good version. The database cluster is configured to generate automated backups with a retention period of 14 days. The initial attack occurred 5 days ago at exactly 3:15 PM\nWhich solution will meet this requirement?
- A. Identify the Regional duster ARN for the database. Use the ARN to restore the Regional cluster by using the Restore to point in time feature. Set a target time 5 days ago at 3:14 PM.
- B. Identify the Regional cluster ARN for the database. List snapshots that have been taken of the cluster. Restore the database by using the snapshot that has a creation time that is closest to 5 days ago at 3:14 PM.
- C. List all snapshots that have been taken of all the company's RDS databases. Identify the snapshot that was taken closest to 5 days ago at 3:14 PM and restore it.
- D. Identify the Regional cluster ARN for the database. Use the ARN to restore the Regional cluster by using the Restore to point in time feature. Set a target time 14 days ago.
Answer: A
Explanation: Option A is the correct solution because it uses RDS point-in-time recovery (PITR) to restore the database to a state just before the attack occurred. Since the attack happened at exactly 3:15 PM five days ago, setting the target time to 5 days ago at 3:14 PM will restore the database to its last known good state—exactly one minute before the malicious attack. Point-in-time recovery is more precise than restoring from snapshots because it allows restoration to any second within the retention period (in this case, 14 days). Option B is incorrect because snapshot-based recovery is less precise and may not represent the latest good state. Option C is wrong because it searches across all company RDS databases rather than the specific affected cluster. Option D would restore the database to 14 days ago, resulting in a 9-day loss of valid data, which is not the last known good version.
Question 43 · No. 67 · Single choice
A company is using AWS Organizations with the default SCP. The company needs to restrict AWS usage for all AWS accounts that are in a specific OU.\nExcept for some desired global services, the AWS usage must occur only in the eu-west-1 Region for all accounts in the OU. A security engineer must create an SCP that applies the restriction to existing accounts and any new accounts in the OU.\nWhich SCP will meet these requirements?
- A. 请提供需要翻译的英文内容，我会为您翻译成中文。
- B. 请提供您需要翻译的英文内容。
- C. 请提供需要翻译的英文内容。
- D. 请提供需要翻译的英文内容。
Answer: C
Question 44 · No. 68 · Single choice
A security engineer for a company needs to design an incident response plan that addresses compromised IAM user account credentials. The company uses an organization in AWS Organizations and AWS IAM Identify Center to manage user access. The company uses a delegated administrator account to implement AWS Security Hub. The delegated administrator account contains an organizational trail in AWS CloudTrail that logs all events to an Amazon S3 bucket. The company has also configured an organizational event data store that captures all events from the trail.\nThe incident response plan must provide steps that the security engineer can take to immediately disable any compromised IAM user when the security engineer receives a notification of a security incident.\nThe plan must prevent the IAM user from being used in any AWS account. The plan must also collect all AWS actions that the compromised IAM user performed across all accounts in the previous 7 days.\nWhich solution will meet these requirements?
- A. Disable the compromised IAM user in the organization management account. Use Amazon Athena to query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed in the previous 7 days.
- B. Remove all IAM policies that are attached to the IAM user in the organization management account. Use Security Hub to query the CloudTrail logs for actions that the IAM user performed in the previous 7 days.
- C. Remove any permission sets that arc assigned to the IAM user in IAM Identity Center. Use Amazon CloudWatch Logs Insights to directly query the organizational CloudTrail logs in the S3 bucket for actions that the IAM user performed m the previous 7 days.
- D. Disable the IAM user's access in IAM Identity Center. Use CloudTrail to query the organizational event data store for actions that the IAM user performed in the previous 7 days.
Answer: D
Explanation: Option D is correct because the company uses AWS IAM Identity Center to manage user access across the organization. Disabling the IAM user's access in IAM Identity Center is the most immediate and effective way to prevent the user from accessing any AWS account in the organization. For investigating the user's actions over the previous 7 days, the company has already configured an organizational event data store in CloudTrail (CloudTrail Lake), which is specifically designed to query CloudTrail events across all accounts in the organization using a SQL-like query language, making it the ideal tool for this task. Option A and B fail because they target IAM users/policies in the organization management account, but the company uses IAM Identity Center for access management, so disabling IAM directly would not prevent Identity Center-based access. Option C is incorrect because removing permission sets is a heavier action and CloudWatch Logs Insights is not the appropriate tool to query CloudTrail logs stored in S3; it is meant for CloudWatch Logs, not S3-based logs.
Question 45 · No. 69 · Single choice
A company wants to deny a specific federated user named Bob access to an Amazon S3 bucket named DOC-EXAMPLE-BUCKET. The company wants to meet this requirement by using a bucket policy. The company also needs to ensure that this bucket policy affects Bob's S3 permissions only. Any other permissions that Bob has must remain intact.\nWhich policy should the company use to meet these requirements?
- A. 您好，您还没有提供需要翻译的英文内容。请提供需要翻译的英文文本，我会为您准确翻译成中文。
- B. 你好！你还没有提供需要翻译的英文内容。请把需要翻译的英文文本发送给我，我会为你翻译成中文。
- C. 请提供需要翻译的英文内容，我将为您翻译成中文。
- D. 请提供需要翻译的英文内容。
Answer: B
Question 46 · No. 70 · Single choice
A company is implementing a new application in a new AWS account. A VPC and subnets have been created for the application. The application has been peered to an existing VPC in another account in the same AWS Region for database access Amazon EC2 instances will regularly be created and terminated in the application VPC, but only some of them will need access to the databases in the peered VPC over TCP port 1521. A security engineer must ensure that only the EC2 instances that need access to the databases can access them through the network.\nHow can the security engineer implement this solution?
- A. Create a new security group in the database VPC and create an inbound rule that allows all traffic from the IP address range of the application VPC. Add a new network ACL rule on the database subnets. Configure the rule to TCP port 1521 from the IP address range of the application VPC. Attach the new security group to the database instances that the application instances need to access.
- B. Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Create a new security group in the database VPC with an inbound rule that allows the IP address range of the application VPC over port 1521. Attach the new security group to the database instances and the application instances that need database access.
- C. Create a new security group in the application VPC with no inbound rules. Create a new security group in the database VPC with an inbound rule that allows TCP port 1521 from the new application security group in the application VPAttach the application security group to the application instances that need database access and attach the database security group to the database instances.
- D. Create a new security group in the application VPC with an inbound rule that allows the IP address range of the database VPC over TCP port 1521. Add a new network ACL rule on the database subnets. Configure the rule to allow all traffic from the IP address range of the application VPC. Attach the new security group to the application instances that need database access.
Answer: C
Explanation: Option C is the correct answer because it leverages AWS security group referencing across peered VPCs, which is a native AWS feature. By creating a security group in the application VPC and referencing it in the database VPC's security group inbound rule (allowing TCP port 1521), only EC2 instances that have the application security group attached will be able to access the databases. This solution is dynamic and does not require updating rules when instances are created or terminated, since security group references automatically include all associated instances. Options A, B, and D rely on IP address ranges, which is problematic because EC2 instances are regularly created and terminated, causing IP addresses to change frequently. Additionally, using IP ranges would allow all instances in that range to access the databases, violating the requirement that only specific instances need access.
Question 47 · No. 71 · Single choice
A security engineer is troubleshooting an AWS Lambda function that is named MyLambdaFunction. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The S3 bucket has the following bucket policy:
<img title="image1" src="https://img.examtopics.com/aws-certified-security-specialty-scs-c03/image1.png">
Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?
- A. Remove the Condition element. Change the Principal element to the following:
- B. Change the Action element to the following:
- C. Change the Resource element to "arn:aws:s3:::DOC-EXAMPLE- BUCKET/*''.
- D. Change the Resource element to "arn:aws:lambda:::function:MyLambdaFunction". Change the Principal element to the following:
Answer: C
Explanation: The correct change is to update the Resource element to 'arn:aws:s3:::DOC-EXAMPLE-BUCKET/*'. The bucket policy needs to grant access not only to the bucket itself but to the objects within the bucket. The /* suffix is required to specify all objects inside the bucket. Without it, the policy only grants access to the bucket metadata, not the actual objects. Option A is incorrect because the Condition element is typically needed for security restrictions and removing it would weaken security unnecessarily. Option B is incorrect because the Action element is likely already correctly set to actions like s3:GetObject. Option D is incorrect because the Resource should refer to the S3 bucket and its objects, not the Lambda function.
Question 48 · No. 72 · Single choice
A company uses AWS Organizations with all features enabled. The company has enabled AWS Security Hub in all member accounts and in all AWS Regions. The company has created a VPC in the eu-central-1 Region in a member AWS account. A security engineer has verified that no security group rules in the VPC allow inbound traffic from all IP addresses on TCP port 22. The security engineer needs an automated system. The system must prevent the creation of security group rules in the VPC that allow traffic from all IP addresses on TCP port 22. Which solution will meet these requirements?
- A. Enable an AWS CloudTrail organization trail that logs to an Amazon CloudWatch Logs log group. Create a CloudWatch alarm based on a log group metric filter. Configure the alarm to publish to an Amazon Simple Notification Service (Amazon SNS) topic when a security group rule is added that allows inbound traffic from all IP addresses. Subscribe the security engineer's email address to the SNS topic.
- B. Create an Amazon EventBridge rule that filters for Security Hub findings about security group rules that allow inbound traffic from all IP addresses on TCP port 22. Configure the EventBridge rule to target an AWS Lambda function that removes the unwanted security group rule.
- C. Create an SCP that prevents the creation or modification of security group rules that allow inbound traffic from all IP addresses on TCP port 22.
- D. Deploy AWS Network Firewall with a rule that inspects all inbound traffic and prevents incoming traffic on TCP port 22.
Answer: B
Explanation: Option B is the correct solution because it implements an automated, event-driven remediation system. Security Hub continuously monitors for findings about security group rules allowing 0.0.0.0/0 on port 22. When such a finding is detected, EventBridge triggers a Lambda function that automatically removes the offending rule, effectively preventing it from persisting. Option A is only detective (alerts after creation) and doesn't remove the rule. Option C (SCP) cannot work because SCPs cannot inspect the specific parameters of a security group rule (such as the CIDR block and port number) - they can only deny API calls entirely or based on broad conditions. Option D is for network traffic inspection at the packet level, not for controlling security group rule creation.
Question 49 · No. 73 · Single choice
A company has enabled AWS Config for its organization in AWS Organizations. The company has deployed hundreds of Amazon S3 buckets across the organization.\nA security engineer needs to identify any S3 buckets that are not encrypted with AWS Key Management Service (AWS KMS). The security engineer also must prevent objects that are not encrypted with AWS KMS from being uploaded to the S3 buckets.\nWhich solution will meet these requirements?
- A. Use the s3-default-encryplion-kms AWS. Config managed rule to identity unencrypted S3 buckets. Create an SCP to allow the s3:PutObject action only when the object is encrypted with AWS KMS.
- B. Use the s3-default-encryption-kms AWS. Config managed rule to identify unencrypted S3 buckets. Create bucket policies for each S3 bucket to deny the s3:PutObject action only when the object has server-since encryption with S3 managed keys (SSE-S3).
- C. Use the s3-bucket-ssl-requests-only AWS Config managed rule to identify unencrypted S3 buckets. Create an SCP to allow the s3:PutObject action only when the object is encrypted with AWS KMS.
- D. Use the s3-bucket-ssl-requests-only AWS Config managed rule to identify unencrypted S3 buckets. Create bucket policies for each S3 bucket to allow the s3:PutObject action only when the object is encrypted with AWS KMS.
Answer: A
Explanation: The correct answer is A because: 1) s3-default-encryption-kms is the correct AWS Config managed rule to identify S3 buckets that are not encrypted with AWS KMS. The s3-bucket-ssl-requests-only rule (options C and D) only checks for SSL requests, not KMS encryption, so it's incorrect. 2) SCPs (Service Control Policies) are the ideal solution for AWS Organizations because they centrally enforce policies across all accounts and hundreds of S3 buckets, rather than requiring individual bucket policies for each bucket (option B), which would be impractical at scale. The SCP can deny the s3:PutObject action when the object is not encrypted with AWS KMS, effectively preventing non-KMS encrypted uploads across the entire organization.
Question 50 · No. 74 · Single choice
A security engineer is designing security controls for a fleet of Amazon EC2 instances that run sensitive workloads in a VPC. The security engineer needs to implement a solution to detect and mitigate software vulnerabilities on the EC2 instances.\nWhich solution will meet this requirement?
- A. Scan the EC2 instances by using Amazon Inspector. Apply security patches and updates by using AWS Systems Manager Patch Manager.
- B. Install host-based firewall and antivirus software on each EC2 instance. Use AWS Systems Manager Run Command to update the firewall and antivirus software.
- C. Install the Amazon CloudWatch agent on the EC2 instances. Enable detailed logging. Use Amazon EventBridge to review the software logs for anomalies.
- D. Scan the EC2 instances by using Amazon GuardDuty Malware Protection. Apply security patches and updates by using AWS Systems Manager Patch Manager.
Answer: A
Explanation: Amazon Inspector is specifically designed to scan EC2 instances for software vulnerabilities and unintended network exposure. It performs automated security assessments that identify vulnerabilities. AWS Systems Manager Patch Manager is the appropriate service to apply security patches and updates to remediate those vulnerabilities. Together, these services directly meet the requirement to detect and mitigate software vulnerabilities. Option B focuses on firewall/AV protection rather than vulnerability scanning. Option C is for log monitoring and anomaly detection, not vulnerability detection. Option D's GuardDuty Malware Protection focuses on malware threats, not general software vulnerabilities.