Practice Free SCS-C03 Exam Online Questions
A company’s security engineer receives an abuse notification from AWS. The notification indicates that someone is hosting malware from the company’s AWS account. After investigation, the security engineer finds a new Amazon S3 bucket that an IAM user created without authorization.
Which combination of steps should the security engineer take to MINIMIZE the consequences of this compromise? (Select THREE.)
- A . Encrypt all AWS CloudTrail logs.
- B . Turn on Amazon GuardDuty.
- C . Change the password for all IAM users.
- D . Rotate or delete all AWS access keys.
- E . Take snapshots of all Amazon Elastic Block Store (Amazon EBS) volumes.
- F . Delete any resources that are unrecognized or unauthorized.
A company is using AWS WAF to protect a customized public API service that is based on Amazon EC2 instances. The API uses an Application Load Balancer. The AWS WAF web ACL is configured with an AWS Managed Rules rule group. After a software upgrade to the API and the client application, some types of requests are no longer working and are causing application stability issues. A security engineer discovers that AWS WAF logging is not turned on for the web ACL.
The security engineer needs to immediately return the application to service, resolve the issue, and ensure that logging is not turned off in the future. The security engineer turns on logging for the web ACL and specifies Amazon CloudWatch Logs as the destination.
Which additional set of steps should the security engineer take to meet the requirements?
- A . Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.
- B . Edit the rules in the web ACL to include rules with Count actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs.
- C . Edit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the AWS WAF resource policy so that AWS WAF administrators cannot remove the logging configuration for any AWS WAF web ACLs.
- D . Edit the rules in the web ACL to include rules with Count and Challenge actions. Review the logs to determine which rule is blocking the request. Modify the IAM policy of all AWS WAF administrators so that they cannot remove the logging configuration for any AWS WAF web ACLs.
A company is expanding its group of stores. On the day that each new store opens, the company wants to launch a customized web application for that store. Each store’s application will have a non-production environment and a production environment. Each environment will be deployed in a separate AWS account. The company uses AWS Organizations and has an OU that is used only for these accounts.
The company distributes most of the development work to third-party development teams. A security engineer needs to ensure that each team follows the company’s deployment plan for AWS resources. The security engineer also must limit access to the deployment plan to only the developers who need access. The security engineer already has created an AWS CloudFormation template that implements the deployment plan.
What should the security engineer do next to meet the requirements in the MOST secure way?
- A . Create an AWS Service Catalog portfolio in the organization’s management account. Upload the CloudFormation template. Add the template to the portfolio’s product list. Share the portfolio with the OU.
- B . Use the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. In the OU, create an SCP that allows access to the extension.
- C . Create an AWS Service Catalog portfolio in the organization’s management account. Upload the CloudFormation template. Add the template to the portfolio’s product list. Create an IAM role that has a trust policy that allows cross-account access to the portfolio for users in the OU accounts. Attach the AWSServiceCatalogEndUserFullAccess managed policy to the role.
- D . Use the CloudFormation CLI to create a module from the CloudFormation template. Register the module as a private extension in the CloudFormation registry. Publish the extension. Share the extension with the OU.
A company has a VPC that has no internet access and has the private DNS hostnames option enabled. An Amazon Aurora database is running inside the VPC. A security engineer wants to use AWS Secrets Manager to automatically rotate the credentials for the Aurora database. The security engineer configures the Secrets Manager default AWS Lambda rotation function to run inside the same VPC that the Aurora database uses. However, the security engineer determines that the password cannot be rotated properly because the Lambda function cannot communicate with the Secrets Manager endpoint.
What is the MOST secure way that the security engineer can give the Lambda function the ability to communicate with the Secrets Manager endpoint?
- A . Add a NAT gateway to the VPC to allow access to the Secrets Manager endpoint .
- B . Add a gateway VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.
- C . Add an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.
- D . Add an internet gateway for the VPC to allow access to the Secrets Manager endpoint.
A security engineer recently rotated the host keys for an Amazon EC2 instance. The security engineer is trying to access the EC2 instance by using the EC2 Instance Connect feature. However, the security engineer receives an error for failed host key validation. Before the rotation of the host keys, EC2 Instance Connect worked correctly with this EC2 instance.
What should the security engineer do to resolve this error?
- A . Import the key material into AWS Key Management Service (AWS KMS).
- B . Manually upload the new host key to the AWS trusted host keys database.
- C . Ensure that the AmazonSSMManagedInstanceCore policy is attached to the EC2 instance profile.
- D . Create a new SSH key pair for the EC2 instance.
A company’s application uses standard tier SecureString parameters from AWS Systems Manager Parameter Store. The application is receiving error messages when the company tries to update a parameter. The parameter uses an AWS KMS customer managed key for encryption and decryption.
What are the reasons for the error messages? (Select TWO.)
- A . The application does not have the kms: Encrypt permission for the customer managed key.
- B . The customer managed key is already being used to encrypt another SecureString parameter.
- C . Standard tier SecureString parameters cannot use a customer managed key for encryption .
- D . The customer managed key that is specified in the application has its key state set to Disabled.
- E . The customer managed key that is specified in the application is using a key alias instead of a key ID.
A security engineer is designing a solution that will provide end-to-end encryption between clients and Docker containers running in Amazon Elastic Container Service (Amazon ECS). This solution must also handle volatile traffic patterns.
Which solution would have the MOST scalability and LOWEST latency?
- A . Configure a Network Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
- B . Configure an Application Load Balancer to terminate the TLS traffic and then re-encrypt the traffic to the containers.
- C . Configure a Network Load Balancer with a TCP listener to pass through TLS traffic to the containers.
- D . Configure Amazon Route 53 to use multivalue answer routing to send traffic to the containers.
A company’s application team wants to replace an internal application with a new AWS architecture that consists of Amazon EC2 instances, an AWS Lambda function, and an Amazon S3 bucket in a single AWS Region. After an architecture review, the security team mandates that no application network traffic can traverse the public internet at any point. The security team already has an SCP in place for the company’s organization in AWS Organizations to restrict the creation of internet gateways, NAT gateways, and egress-only gateways.
Which combination of steps should the application team take to meet these requirements? (Select THREE.)
- A . Create an S3 endpoint that has a full-access policy for the application’s VPC.
- B . Create an S3 access point for the S3 bucket. Include a policy that restricts the network origin to VPCs.
- C . Launch the Lambda function. Enable the block public access configuration.
- D . Create a security group that has an outbound rule over port 443 with a destination of the
S3 endpoint. Associate the security group with the EC2 instances. - E . Create a security group that has an outbound rule over port 443 with a destination of the S3 access point. Associate the security group with the EC2 instances .
- F . Launch the Lambda function in a VPC.
A company creates AWS Lambda functions from container images that are stored in Amazon Elastic Container Registry (Amazon ECR). The company needs to identify any software vulnerabilities in the container images and any code vulnerabilities in the Lambda functions.
Which solution will meet these requirements?
- A . Enable Amazon GuardDuty. Configure Amazon ECR scanning and Lambda code scanning in GuardDuty.
- B . Enable Amazon GuardDuty. Configure Runtime Monitoring and Lambda Protection in GuardDuty.
- C . Enable Amazon Inspector. Configure Amazon ECR enhanced scanning and Lambda code scanning in Amazon Inspector.
- D . Enable AWS Security Hub. Configure Runtime Monitoring and Lambda Protection in Security Hub.
A company has a platform that is divided into 12 AWS accounts under the same organization in AWS Organizations. Many of these accounts use Amazon API Gateway to expose APIs to the company’s frontend applications. The company needs to protect the existing APIs and any resources that will be deployed in the future against common SQL injection and bot attacks.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Create an AWS WAF web ACL for each API. Include managed rules to block SQL injection and bot attacks. Use AWS Config to detect new resources that do not have a web ACL. Configure a remediation action to provision a web ACL for these resources.
- B . Use AWS Firewall Manager to create an AWS WAF policy. Configure the policy to include the AWS Bot Control and SQL database managed rule groups. Set the policy scope to include the API Gateway stage as the resource type.
- C . Create an AWS Service Catalog product for an AWS WAF web ACL that includes rules to block SQL injection and bot attacks. Use AWS Config to detect new resources that do not have this product applied. Configure a remediation action to provision a web ACL for these resources.
- D . Use AWS Security Hub to detect unprotected resources and to send the findings as custom action events to Amazon EventBridge. Create an AWS Lambda function for these events to provision an AWS WAF web ACL for the unprotected resources. Include managed rules to block SQL injection and bot attacks.