Practice Free SCS-C03 Exam Online Questions
A company has a PHP-based web application that uses Amazon S3 as an object store for user files. The S3 bucket is configured for server-side encryption with Amazon S3 managed keys (SSE-S3). New requirements mandate full control of encryption keys.
Which combination of steps must a security engineer take to meet these requirements? (Select THREE.)
- A . Create a new customer managed key in AWS Key Management Service (AWS KMS) .
- B . Change the SSE-S3 configuration on the S3 bucket to server-side encryption with customer-provided keys (SSE-C).
- C . Configure the PHP SDK to use the SSE-S3 key before upload.
- D . Create an AWS managed key for Amazon S3 in AWS KMS.
- E . Change the SSE-S3 configuration on the S3 bucket to server-side encryption with AWS KMS managed keys (SSE-KMS).
- F . Change all the S3 objects in the bucket to use the new encryption key.
A company uses an incident response team to troubleshoot incidents. The incident response team must use temporary credentials from AWS STS for cross-account IAM role access when troubleshooting. Occasionally, each team member will need to respond to multiple different types of incidents simultaneously. Based on the type of incident, the company wants to dynamically assign minimal permissions to whichever team member responds.
Which solution will meet these requirements?
- A . Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents. Reduce the scope of those permissions by using a session policy.
- B . Attach a policy to the cross-account role that grants the appropriate permissions for all types of incidents. Reduce the scope of those permissions by using a permissions boundary .
- C . Do not assign any permissions to the cross-account role initially. Assign a session policy to the role being assumed with the required permission for that type of incident.
- D . Use an AWS Lambda function for each incident. Configure the function to create a temporary cross-account role that uses the AWS managed policy AWS Security Incident Response Service Role Policy. Reduce the scope of those permissions by using a permissions boundary.
A company must inventory sensitive data across all Amazon S3 buckets in all accounts from a single security account.
- A . Delegate Amazon Macie and Security Hub administration.
- B . Use Amazon Inspector with Security Hub.
- C . Use Inspector with Trusted Advisor.
- D . Use Macie with Trusted Advisor.
A company needs to implement DNS Security Extensions (DNSSEC) for a specific subdomain. The subdomain is already registered with Amazon Route 53. A security engineer has enabled DNSSEC signing and has created a key-signing key (KSK). When the security engineer tries to test the configuration, the security engineer receives an error for a broken trust chain.
What should the security engineer do to resolve this error?
- A . Replace the KSK with a zone-signing key (ZSK).
- B . Deactivate and then activate the KSK.
- C . Create a Delegation Signer (DS) record in the parent hosted zone.
- D . Create a Delegation Signer (DS) record in the subdomain.
A company recently set up Amazon GuardDuty and is receiving a high number of findings from IP addresses within the company. A security engineer has verified that these IP addresses are trusted and allowed.
Which combination of steps should the security engineer take to configure GuardDuty so that it does not produce findings for these IP addresses? (Select TWO.)
- A . Create a plaintext configuration file that contains the trusted IP addresses.
- B . Create a JSON configuration file that contains the trusted IP addresses.
- C . Upload the configuration file directly to GuardDuty.
- D . Upload the configuration file to Amazon S3. Add a new trusted IP list to GuardDuty that points to the file.
- E . Manually copy and paste the configuration file data into the trusted IP list in GuardDuty.
A recent security audit identified that a company’s application team injects database credentials into the environment variables of an AWS Fargate task. The company’s security policy mandates that all sensitive data be encrypted at rest and in transit.
Which combination of actions should the security team take to make the application compliant with the security policy? (Select THREE.)
- A . Store the credentials securely in a file in an Amazon S3 bucket with restricted access to the application team IAM role. Ask the application team to read the credentials from the S3 object instead.
- B . Create an AWS Secrets Manager secret and specify the key-value pairs to be stored in this secret.
- C . Modify the application to pull credentials from the AWS Secrets Manager secret instead of the environment variables.
- D . Add a policy statement to the container instance IAM role that allows ssm: GetParameters , secretsmanager: GetSecretValue, and kms: Decrypt for the required secret and KMS key .
- E . Add a policy statement to the task role or task execution role that allows ssm: GetParameters, secretsmanager: GetSecretValue, and kms: Decrypt for the required secret and KMS key.
- F . Log in to the AWS Fargate instance, create a script to read the secret value from AWS Secrets Manager, and inject the environment variables. Ask the application team to redeploy the application.
A company has an AWS account that hosts a production application. The company receives an email notification that Amazon GuardDuty has detected an Impact: IAMUser/AnomalousBehavior finding in the account. A security engineer needs to run the investigation playbook for this security incident and must collect and analyze the information without affecting the application.
Which solution will meet these requirements MOST quickly?
- A . Log in to the AWS account by using read-only credentials. Review the GuardDuty finding for details about the IAM credentials that were used. Use the IAM console to add a DenyAll policy to the IAM principal.
- B . Log in to the AWS account by using read-only credentials. Review the GuardDuty finding to determine which API calls initiated the finding. Use Amazon Detective to review the API calls in context.
- C . Log in to the AWS account by using administrator credentials. Review the GuardDuty finding for details about the IAM credentials that were used. Use the IAM console to add a DenyAll policy to the IAM principal.
- D . Log in to the AWS account by using read-only credentials. Review the GuardDuty finding to determine which API calls initiated the finding. Use AWS CloudTrail Insights and AWS CloudTrail Lake to review the API calls in context.
A company needs to implement data lifecycle management for Amazon RDS snapshots. The company will use AWS Backup to manage the snapshots. The company must retain RDS automated snapshots for 5 years and will use Amazon S3 for long-term archival storage.
Which solution will meet these requirements?
- A . Use AWS Backup to apply a 5-year retention tag to the RDS snapshots.
- B . Enable versioning on the S3 bucket that AWS Backup uses for the RDS snapshots.
Configure a 5-year retention period. - C . Create an S3 Lifecycle policy. Include a 5-year retention period for the S3 bucket that AWS Backup uses for the RDS snapshots.
- D . Create a backup plan in AWS Backup. Configure a 5-year retention period.
A company is running a dynamic website by using an Application Load Balancer (ALB). A
security engineer notices that bots from different IP addresses are using brute-force attacks to invoke a service endpoint frequently.
What is the FASTEST way to mitigate this problem?
- A . Create an AWS Lambda function to process ALB logs. Block the bots’ IP addresses in the ALB’s security group.
- B . Create an AWS WAF web ACL for the ALB. Add a rate-based rule to the web ACL to block the bots.
- C . Create an ALB listener rule. Combine source-ip and path-pattern as the conditions to match bots. Specify a fixed-response action to return an HTTP 403 status.
- D . Create an AWS WAF web ACL for the ALB. Add a rate-based rule to a rule group to block the bots. Attach the rule to the web ACL.
A company needs to scan all AWS Lambda functions for code vulnerabilities.
- A . Use Amazon Macie.
- B . Enable Amazon Inspector Lambda scanning.
- C . Use GuardDuty and Security Hub.
- D . Use GuardDuty Lambda Protection.