SCS-C03 Question Bank · Latest 50 Questions Free Preview (Page 3/5)
Questions 21–30 of the latest 50 SCS-C03 questions (5 pages total), with answers and explanations, no login required. Practice all 74 questions online.
Question 21 · No. 45 · Single choice
An IAM user receives an Access Denied message when the user attempts to access objects in an Amazon S3 bucket. The user and the S3 bucket are in the same AWS account. The S3 bucket is configured to use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt all of its objects at rest by using a customer managed key from the same AWS account. The S3 bucket has no bucket policy defined. The IAM user has been granted permissions through an IAM policy that allows the kms:Decrypt permission to the customer managed key. The IAM policy also allows the s3:List* and s3:Get* permissions for the S3 bucket and its objects.
Which of the following is a possible reason that the IAM user cannot access the objects in the S3 bucket?
- A. The IAM policy needs to allow the kms:DescribeKey permission.
- B. The S3 bucket has been changed to use the AWS managed key to encrypt objects at rest.
- C. An S3 bucket policy needs to be added to allow the IAM user to access the objects.
- D. The KMS key policy has been edited to remove the ability for the AWS account to have full access to the key.
Answer: D
Question 22 · No. 46 · Single choice
A company that uses AWS Organizations is using AWS IAM Identity Center (AWS Single Sign-On) to administer access to AWS accounts. A security engineer is creating a custom permission set in IAM Identity Center. The company will use the permission set across multiple accounts. An AWS managed policy and a customer managed policy are attached to the permission set. The security engineer has full administrative permissions and is operating in the management account.
When the security engineer attempts to assign the permission set to an IAM Identity Center user who has access to multiple accounts, the assignment fails.
What should the security engineer do to resolve this failure?
- A. Create the customer managed policy in every account where the permission set is assigned. Give the customer managed policy the same name and same permissions in each account.
- B. Remove either the AWS managed policy or the customer managed policy from the permission set. Create a second permission set that includes the removed policy. Apply the permission sets separately to the user.
- C. Evaluate the logic of the AWS managed policy and the customer managed policy. Resolve any policy conflicts in the permission set before deployment.
- D. Do not add the new permission set to the user. Instead, edit the user's existing permission set to include the AWS managed policy and the customer managed policy.
Answer: A
Explanation: When using AWS IAM Identity Center with AWS Organizations, if a permission set includes a customer managed policy, that customer managed policy must exist in every AWS account where the permission set will be assigned. Since the security engineer is operating in the management account and trying to assign the permission set to a user with access to multiple accounts, the assignment fails because the customer managed policy only exists in the management account. The solution is to create the customer managed policy in every target account with the same name and permissions. Option B is incorrect because removing policies undermines the purpose of the permission set. Option C is incorrect because policy conflicts are not the described issue. Option D is incorrect because editing existing permission sets does not resolve the cross-account policy availability issue.
Question 23 · No. 47 · Multiple choice
A company finds that one of its Amazon EC2 instances suddenly has a high CPU usage. The company does not know whether the EC2 instance is compromised or whether the operating system is performing background cleanup.
Which combination of steps should a security engineer take before investigating the issue? (Choose three.)
- A. Disable termination protection for the EC2 instance if termination protection has not been disabled.
- B. Enable termination protection for the EC2 instance if termination protection has not been enabled.
- C. Take snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
- D. Remove all snapshots of the Amazon Elastic Block Store (Amazon EBS) data volumes that are attached to the EC2 instance.
- E. Capture the EC2 instance metadata, and then tag the EC2 instance as under quarantine.
- F. Immediately remove any entries in the EC2 instance metadata that contain sensitive information.
Answer: B, C, E
Explanation: The correct combination of steps before investigating the EC2 instance issue is: (B) Enable termination protection to prevent the instance from being accidentally terminated and destroying potential evidence during the investigation; (C) Take snapshots of EBS data volumes to preserve the state of the data for forensic analysis; (E) Capture the EC2 instance metadata and tag the instance as under quarantine to preserve important information and track its status during investigation. Option A is incorrect because disabling termination protection would risk losing evidence. Option D is incorrect because removing snapshots would destroy forensic evidence. Option F is incorrect because EC2 instance metadata is read-only and managed by AWS, and removing entries would destroy evidence rather than preserve it.
Question 24 · No. 48 · Single choice
A company uses Amazon EC2 instances to host frontend services behind an Application Load Balancer. Amazon Elastic Block Store (Amazon EBS) volumes are attached to the EC2 instances. The company uses Amazon S3 buckets to store large files for images and music.
The company has implemented a security architecture on AWS to prevent, identify, and isolate potential ransomware attacks. The company now wants to further reduce risk.
A security engineer must develop a disaster recovery solution that can recover to normal operations if an attacker bypasses preventive and detective controls. The solution must meet an RPO of 1 hour.
Which solution will meet these requirements?
- A. Use AWS Backup to create backups of the EC2 instances and S3 buckets every hour. Create AWS CloudFormation templates that replicate existing architecture components. Use AWS CodeCommit to store the CloudFormation templates alongside application configuration code.
- B. Use AWS Backup to create backups of the EBS volumes and S3 objects every day. Use Amazon Security Lake to create a centralized data lake for AWS CloudTrail logs and VPC flow logs. Use the logs for automated response.
- C. Use Amazon Security Lake to create a centralized data lake for AWS CloudTrail logs and VPC flow logs. Use the logs for automated response. Enable AWS Security Hub to establish a single location for recovery procedures. Create AWS CloudFormation templates that replicate existing architecture components. Use AWS CodeCommit to store the CloudFormation templates alongside application configuration code.
- D. Create EBS snapshots every 4 hours. Enable Amazon GuardDuty Malware Protection. Create automation to immediately restore the most recent snapshot for any EC2 instances that produce an Execution:EC2/MaliciousFile finding in GuardDuty.
Answer: A
Explanation: Option A is the correct choice because it meets all the specified requirements: (1) It uses AWS Backup to create backups of EC2 instances and S3 buckets every hour, which satisfies the RPO of 1 hour. (2) It uses AWS CloudFormation templates to replicate the existing architecture, enabling rapid infrastructure recreation in a disaster recovery scenario. (3) Storing the templates in AWS CodeCommit ensures version control and availability of the recovery configuration. The other options fail because: Option B only backs up daily (failing the 1-hour RPO); Option C focuses on detection and response via logs but lacks an actual backup mechanism with sufficient frequency; Option D creates snapshots every 4 hours (failing the 1-hour RPO) and only addresses EBS volumes without covering S3 data.
Question 25 · No. 49 · Single choice
A company runs an application on a fleet of Amazon EC2 instances. The company can remove instances from the fleet without risk to the application. All EC2 instances use the same security group named ProdFleet. Amazon GuardDuty and AWS Config are active in the company's AWS account.
A security engineer needs to provide a solution that will prevent an EC2 instance from sending outbound traffic if GuardDuty generates a cryptocurrency finding event. The security engineer creates a new security group named isolate that contains no outbound rules. The security engineer configures an AWS Lambda function to remove an EC2 instance from the ProdFleet security group and add it to the isolate security group.
Which additional step will meet this requirement?
- A. Configure GuardDuty to directly invoke the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.
- B. Configure an AWS Config rule that invokes the Lambda function if a CryptoCurroncy:EC2/* configuration change event occurs for an EC2 instance.
- C. Configure an Amazon EventBridge rule that invokes the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event.
- D. Configure an Amazon EventBridge rule that invokes the Lambda function if AWS Config detects a CryptoCurrency:ЕС2/* configuration change event for an EC2 instance.
Answer: C
Explanation: The correct answer is C: Configure an Amazon EventBridge rule that invokes the Lambda function if GuardDuty generates a CryptoCurrency:EC2/* finding event. Amazon GuardDuty findings cannot directly invoke Lambda functions, which eliminates option A. AWS Config tracks configuration changes to AWS resources but does not monitor GuardDuty findings as configuration change events, which eliminates options B and D. Amazon EventBridge is the AWS event bus service that integrates with GuardDuty—GuardDuty automatically sends all findings to EventBridge as events. By creating an EventBridge rule with an event pattern matching the CryptoCurrency:EC2/* finding type, the rule can trigger the Lambda function to move the affected EC2 instance from the ProdFleet security group to the isolate security group, which has no outbound rules. This effectively prevents the compromised instance from sending any outbound traffic.
Question 26 · No. 50 · Multiple choice
A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises data center for compliance reasons. The database is sensitive to network latency. Additionally, the data that travels between the on-premises data center and AWS must have IPsec encryption.
Which combination of AWS solutions will meet these requirements? (Choose two.)
- A. AWS Site-to-Site VPN
- B. AWS Direct Connect
- C. AWS VPN CloudHub
- D. VPC peering
- E. NAT gateway
Answer: A, B
Explanation: The requirements are low latency and IPsec encryption. AWS Direct Connect provides a dedicated network connection between on-premises and AWS, which significantly reduces network latency. However, Direct Connect does not provide IPsec encryption by default. AWS Site-to-Site VPN provides IPsec encryption for data in transit. By combining AWS Direct Connect (for low latency) with AWS Site-to-Site VPN (for IPsec encryption over the Direct Connect connection), both requirements are met. Option C (VPN CloudHub) is for connecting multiple sites, not relevant here. Option D (VPC peering) is for connecting VPCs, not on-premises. Option E (NAT gateway) is for outbound internet traffic.
Question 27 · No. 51 · Single choice
A company uses AWS Config rules to identify Amazon S3 buckets that are not compliant with the company’s data protection policy. The S3 buckets are hosted in several AWS Regions and several AWS accounts. The accounts are in an organization in AWS Organizations.
The company needs a solution to remediate the organization’s existing noncompliant S3 buckets and any noncompliant S3 buckets that are created in the future.
Which solution will meet these requirements?
- A. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
- B. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
- C. Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
- D. Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
Answer: A
Explanation: Option A is the correct answer because it addresses both requirements: (1) remediating existing noncompliant S3 buckets, and (2) handling noncompliant S3 buckets created in the future. The AWS Config aggregator with organization-wide resource data aggregation ensures coverage across all current and future accounts and Regions in the organization. The AWS Lambda function automatically responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring them, which handles both existing and newly created noncompliant buckets. Options B and D use SCPs, which can only prevent the creation of new noncompliant S3 buckets but cannot remediate existing ones. Options C and D scope the aggregator only to current accounts and Regions, which would miss new accounts or Regions added in the future.
Question 28 · No. 52 · Single choice
A company uses AWS Organizations. The company has learns that use an AWS CloudHSM hardware security module (HSM) that is hosted in a central AWS account. One of the teams creates its own new dedicated AWS account and wants to use the HSM that is hosted in the central account.
How should a security engineer share the HSM that is hosted in the central account with the new dedicated account?
- A. Use AWS Resource Access Manager (AWS RAM) to share the VPC subnet ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.
- B. Use AWS Identity and Access Management (IAM) to create a cross-account role to access the CloudHSM cluster that is in the central account. Create a new IAM user in the new dedicated account. Assign the cross-account role to the new IAM user.
- C. Use AWS IAM Identity Center to create an AWS Security Token Service (AWS STS) token to authenticate from the new dedicated account to the central account. Use the cross-account permissions that are assigned to the STS token to invoke an operation on the HSM in the central account.
- D. Use AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the now dedicated account.
Answer: A
Explanation: The correct approach for sharing an AWS CloudHSM across accounts within AWS Organizations is to use AWS Resource Access Manager (AWS RAM) to share the VPC subnet where the HSM is located. This allows the new dedicated account to launch client instances in the same subnet, enabling network connectivity to the CloudHSM cluster. Additionally, the CloudHSM security group must be configured to accept inbound traffic from the private IP addresses of client instances in the new account. Option D is incorrect because you cannot share the HSM itself via AWS RAM—only the VPC subnet can be shared. Options B and C are incorrect because IAM roles and STS tokens do not establish the required network connectivity for cross-account CloudHSM usage.
Question 29 · No. 53 · Single choice
A security team manages a company's AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security learn can administer the KMS keys. The company’s application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team's software process with access to the keys.
Which solution will meet these requirements with the LEAST operational overhead?
- A. Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.
- B. Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals. Revert this change when the application team no longer needs access
- C. Create a key grant to allow the application team to use the KMS keys. Revoke the grant when the application team no longer needs access.
- D. Create a new KMS key by generating key material on promises. Import the key material to AWS KMS whenever the application team needs access. Grant the application team permissions to use the key.
Answer: C
Explanation: AWS KMS key grants are specifically designed to provide temporary, programmatic access to KMS keys without modifying the key policy or IAM policies. Grants can be easily created and revoked through API calls, making them ideal for scenarios where access is needed occasionally and temporarily. Option A requires complex HSM management. Option B requires manual policy modifications each time. Option D involves complex key material import/export procedures. Key grants offer the least operational overhead as they are purpose-built for this use case.
Question 30 · No. 54 · Single choice
A startup company is using a single AWS account that has resources in a single AWS Region. A security engineer configures an AWS CloudTrail trail in the same Region to deliver log files to an Amazon S3 bucket by using the AWS CLI.
Because of expansion, the company adds resources in multiple Regions. The security engineer notices that the logs from the new Regions are not reaching the S3 bucket.
What should the security engineer do to fix this issue with the LEAST amount of operational overhead?
- A. Create a new CloudTrail trail. Select the new Regions where the company added resources.
- B. Change the S3 bucket to receive notifications to track all actions from all Regions.
- C. Create a new CloudTrail trail that applies to all Regions.
- D. Change the existing CloudTrail trail so that it applies to all Regions.
Answer: D
Explanation: By default, a CloudTrail trail only logs events from the Region in which it was created. When the security engineer initially set up the trail, it was configured as a single-Region trail in the original Region. To fix the issue with the LEAST amount of operational overhead, the security engineer should modify the existing trail to make it a multi-Region trail by enabling the 'IsMultiRegionTrail' setting. This way, the existing trail will automatically log events from all Regions without requiring the creation of additional trails, which would increase operational overhead.