Practice Free SCS-C03 Exam Online Questions
A security team manages a company’s AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security team can administer the KMS keys. The company’s application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team’s software process with access to the keys.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.
- B . Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals. Revert this change when the application team no longer needs access.
- C . Create a key grant to allow the application team to use the KMS keys. Revoke the grant when the application team no longer needs access.
- D . Create a new KMS key by generating key material on premises. Import the key material to AWS KMS whenever the application team needs access. Grant the application team permissions to use the key.
A security engineer configured VPC Flow Logs to publish to Amazon CloudWatch Logs. After 10 minutes, no logs appear. The issue is isolated to the IAM role associated with VPC Flow Logs.
What could be the reason?
- A . logs: GetLogEvents is missing.
- B . The engineer cannot assume the role.
- C . The vpc-flow-logs.amazonaws.com principal cannot assume the role.
- D . The role cannot tag the log stream.
A company is using AWS Organizations with the default SCP. The company needs to restrict AWS usage for all AWS accounts that are in a specific OU. Except for some desired global services, the AWS usage must occur only in theeu-west-1Region for all accounts in the OU. A security engineer must create an SCP that applies the restriction to existing accounts and any new accounts in the OU.
Which SCP will meet these requirements?
- A . Deny with NotAction, but uses StringEquals for aws: RequestedRegion = eu-west-1
- B . Allow with Action, scoped to desired global services in eu-west-1
- C . Deny with NotAction for desired global services, and StringNotEquals aws: RequestedRegion = eu-west-1
- D . Allow with NotAction and StringNotEquals aws: RequestedRegion = eu-west-1
A company’s security team wants to receive email notification from AWS about any abuse reports regarding DoS attacks. A security engineer needs to implement a solution that will provide a near-real-time alert for any abuse reports that AWS sends for the account. The security engineer already has created an Amazon Simple Notification Service (Amazon SNS) topic and has subscribed the security team’s email address to the topic.
What should the security engineer do next to meet these requirements?
- A . Use the AWS Trusted Advisor API and a scheduled Lambda function to detect AWS_ABUSE_DOS_REPORT notifications.
- B . Create an Amazon EventBridge rule that uses AWS Health and identifies a specific event for AWS_ABUSE_DOS_REPORT. Configure the rule action to publish a message to the SNS topic.
- C . Use the AWS Support API and a scheduled Lambda function to detect abuse report cases.
- D . Use AWS CloudTrail logs with metric filters to detect AWS_ABUSE_DOS_REPORT events.
A company uses an organization in AWS Organizations and AWS IAM Identity Center to manage its AWS environment. The company configures IAM Identity Center to access the company’s on-premises Active Directory through a properly configured AD Connector. All the company’s employees are in an Active Directory group named Cloud.
The employees can view and access nearly all the AWS accounts in the organization, and the employees have the permissions that they require. However, the employees cannot access an account named Account A. The company verifies that Account A exists in the organization.
What is the likely reason that the employees are unable to access Account A?
- A . The company did not add Account A to an organizational unit (OU) within the organization.
- B . The company has not synchronized the Cloud Active Directory group with the on-premises Active Directory.
- C . The company did not assign the Cloud Active Directory group to Account A in IAM Identity Center with a valid permission set.
- D . The company applied an IAM permissions boundary to Account A that is denying access to the account.
A company plans to create Amazon S3 buckets to store log data. All the S3 buckets will have versioning enabled and will use the S3 Standard storage class.
A security engineer needs to implement a solution that protects objects in the S3 buckets from deletion for 90 days. The solution must ensure that no object can be deleted during this time period, even by an administrator or the AWS account root user.
Which solution will meet these requirements?
- A . Enable S3 Object Lock in governance mode. Set a legal hold of 90 days.
- B . Enable S3 Object Lock in governance mode. Set a retention period of 90 days.
- C . Enable S3 Object Lock in compliance mode. Set a retention period of 90 days.
- D . Create an S3 Glacier Vault Lock policy that prevents deletion for 90 days.
A company hosts a web application on an Apache web server. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The company configured the EC2 instances to send the Apache web server logs to an Amazon CloudWatch Logs group that the company has configured to expire after 1 year.
Recently, the company discovered in the Apache web server logs that a specific IP address is sending suspicious requests to the web application. A security engineer wants to analyze the past week of Apache web server logs to determine how many requests that the IP address sent and the corresponding URLs that the IP address requested.
What should the security engineer do to meet these requirements with the LEAST effort?
- A . Export the CloudWatch Logs group data to Amazon S3. Use Amazon Macie to query the logs for the specific IP address and the requested URLs.
- B . Configure a CloudWatch Logs subscription to stream the log group to an Amazon OpenSearch Service cluster. Use OpenSearch Service to analyze the logs for the specific IP address and the requested URLs.
- C . Use CloudWatch Logs Insights and a custom query syntax to analyze the CloudWatch logs for the specific IP address and the requested URLs.
- D . Export the CloudWatch Logs group data to Amazon S3. Use AWS Glue to crawl the S3 bucket for only the log entries that contain the specific IP address. Use AWS Glue to view the results.
A company allows users to download its mobile app onto their phones. The app is MQTT based and connects to AWS IoT Core to subscribe to specific client-related topics. Recently, the company discovered that some malicious attackers have been trying to get a Trojan horse onto legitimate mobile phones. The Trojan horse poses as the authentic application and uses a client ID with injected special characters to gain access to topics outside the client’s privilege scope.
Which combination of actions should the company take to prevent this threat? (Select TWO.)
- A . In the application, use an IoT thing name as the client ID to connect the device to AWS IoT Core.
- B . In the application, add a client ID check. Disconnect from the server if any special character is detected.
- C . Apply an AWS IoT Core policy that allows "AWSIoTWirelessDataAccess" with the principal set to "client/${iot: Connection.Thing.ThingName}".
- D . Apply an AWS IoT Core policy to the device to allow "iot: Connect" with the resource set to "client/${iot: ClientId}".
- E . Apply an AWS IoT Core policy to the device to allow "iot: Connect" with the resource set to "client/${iot: Connection.Thing.ThingName}".
A company runs several applications on Amazon Elastic Kubernetes Service (Amazon EKS).
The company needs a solution to detect any Kubernetes security risks by monitoring Amazon EKS audit logs in addition to operating system, networking, and file events. The solution must send email alerts for any identified risks to a mailing list that is associated with a security team.
Which solution will meet these requirements?
- A . Deploy AWS Security Hub and enable security standards that contain EKS controls. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team’s mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant Security Hub events to the SNS topic.
- B . Enable Amazon Inspector container image scanning. Configure Amazon Detective to analyze EKS security logs. Create Amazon CloudWatch log groups for EKS audit logs. Use an AWS Lambda function to process the logs and to send email alerts to the security team.
- C . Enable Amazon GuardDuty. Enable EKS Protection and Runtime Monitoring for Amazon EKS in GuardDuty. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team’s mailing list as a subscriber. Use an Amazon EventBridge rule to send relevant GuardDuty events to the SNS topic.
- D . Install the AWS Systems Manager Agent (SSM Agent) on all EKS nodes. Configure Amazon CloudWatch Logs to collect EKS audit logs. Create an Amazon Simple Notification Service (Amazon SNS) topic and set the security team’s mailing list as a subscriber. Configure a CloudWatch alarm to publish a message to the SNS topic when new audit logs are generated.
A company runs ECS services behind an internet-facing ALB that is the origin for CloudFront. An AWS WAF web ACL is associated with CloudFront, but clients can bypass it by accessing the ALB directly.
Which solution will prevent direct access to the ALB?
- A . Use AWS PrivateLink with the ALB.
- B . Replace the ALB with an internal ALB.
- C . Restrict ALB listener rules to CloudFront IP ranges.
- D . Require a custom header from CloudFront and validate it at the ALB.