Practice Free SCS-C03 Exam Online Questions
A company has an AWS Lambda function that requires access to an Amazon S3 bucket. The company’s security policy requires that connections to Amazon S3 are over a private network and are secure.
The company has configured a gateway VPC endpoint in the VPC to allow access to Amazon S3. The company has configured the Lambda function to run inside the VPC. Additionally, the company has configured the Lambda function to use a private subnet that has a route to the internet through a NAT gateway. Other resources in the VPC use this private subnet to access the internet successfully. When the Lambda function runs, it uses the NAT gateway instead of the gateway VPC endpoint to access Amazon S3.
What can a security engineer do to ensure that the Lambda function uses the gateway VPC endpoint for Amazon S3?
- A . Remove the route to the NAT gateway within the route table of the private subnet that the Lambda function uses.
- B . Associate the gateway VPC endpoint with the route table of the private subnet that the Lambda function uses.
- C . Adjust the gateway VPC endpoint policy to allow access from the Lambda function’s network interface address.
- D . Configure the Lambda function’s security group to allow connections to the S3 network address space.
A security engineer is troubleshooting an AWS Lambda function that is named My Lambda Function. The function is encountering an error when the function attempts to read the objects in an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET .
The S3 bucket has the following bucket policy:
{
"Effect": "Allow" , "Principal": { "Service": "lambda.amazonaws.com" } , "Action": "s3: GetObject" , "Resource": "arn: aws: s3::: DOC-EXAMPLE-BUCKET" , "Condition": {
"ArnLike": {
"aws: SourceArn": "arn: aws: lambda::: function: MyLambdaFunction"
}
}
}
Which change should the security engineer make to the policy to ensure that the Lambda function can read the bucket objects?
- A . Remove the Condition element .
Change the Principal element to the following:{ "AWS":
"arn: aws: lambda::: function: MyLambdaFunction" } - B . Change the Action element to the following:["s3: GetObject*", "s3: GetBucket*"]
- C . Change the Resource element to"arn: aws: s3::: DOC-EXAMPLE-BUCKET/*".
- D . Change the Resource element to "arn: aws: lambda::: function: MyLambdaFunction". Change the Principal element to the following:{ "Service": "s3.amazonaws.com" }
A company begins to use AWS WAF after experiencing an increase in traffic to the company’s public web applications. A security engineer needs to determine if the increase in traffic is because of application-layer attacks. The security engineer needs a solution to analyze AWS WAF traffic.
Which solution will meet this requirement?
- A . Send AWS WAF logs to AWS CloudTrail and analyze them with OpenSearch.
- B . Send AWS WAF logs to Amazon S3 and query them directly with OpenSearch.
- C . Send AWS WAF logs to Amazon S3. Create an Amazon Athena table with partition projection. Use Athena to query the logs.
- D . Send AWS WAF logs to AWS CloudTrail and analyze them with Amazon Athena.
A security team manages a company’s AWS Key Management Service (AWS KMS) customer managed keys. Only members of the security team can administer the KMS keys. The company’s application team has a software process that needs temporary access to the keys occasionally. The security team needs to provide the application team’s software process with access to the keys.
Which solution will meet these requirements with the LEAST operational overhead?
- A . Export the KMS key material to an on-premises hardware security module (HSM). Give the application team access to the key material.
- B . Edit the key policy that grants the security team access to the KMS keys by adding the application team as principals. Revert this change when the application team no longer needs access.
- C . Create a key grant to allow the application team to use the KMS keys. Revoke the grant when the application team no longer needs access.
- D . Create a new KMS key by generating key material on premises. Import the key material to AWS KMS whenever the application team needs access. Grant the application team permissions to use the key.
A company has installed a third-party application that is distributed on several Amazon EC2 instances and on-premises servers. Occasionally, the company’s IT team needs to use SSH to connect to each machine to perform software maintenance tasks. Outside these time slots, the machines must be completely isolated from the rest of the network. The company does not want to maintain any SSH keys. Additionally, the company wants to pay only for machine hours when there is an SSH connection.
Which solution will meet these requirements?
- A . Create a bastion host with port forwarding to connect to the machines.
- B . Set up AWS Systems Manager Session Manager to allow temporary connections.
- C . Use AWS CloudShell to create serverless connections.
- D . Set up an interface VPC endpoint for each machine for private connection.
A security engineer needs to prepare a company’s Amazon EC2 instances for quarantine during a security incident. The AWS Systems Manager Agent (SSM Agent) has been deployed to all EC2 instances. The security engineer has developed a script to install and update forensics tools on the EC2 instances.
Which solution will quarantine EC2 instances during a security incident?
- A . Create a rule in AWS Config to track SSM Agent versions.
- B . Configure Systems Manager Session Manager to deny all connection requests from external IP addresses.
- C . Store the script in Amazon S3 and grant read access to the instance profile.
- D . Configure IAM permissions for the SSM Agent to run the script as a predefined Systems Manager Run Command document.
A company has an Amazon RDS database. The database contains sensitive data that is shared across teams in the company. The company needs a solution to detect anomalous logins to the database. The solution must notify an existing Amazon SNS topic when anomalous logins occur.
Which solution will meet these requirements?
- A . Use AWS Trusted Advisor security checks for Amazon RDS. Create an Amazon EventBridge rule to monitor the security checks for status changes. Configure the EventBridge rule to invoke an AWS Lambda function to publish a message to the SNS topic.
- B . Enable AWS AppFabric. Connect AWS AppFabric to the RDS DB instance. Create an Amazon Data Firehose stream as the destination for the AWS AppFabric findings. Create an
AWS Lambda function that is invoked by the Firehose stream to publish a message to the SNS topic. - C . Enable Amazon GuardDuty and configure GuardDuty RDS Protection. Create an Amazon EventBridge rule to monitor GuardDuty findings of anomalous logins. Configure the SNS topic as the target of the EventBridge rule.
- D . Enable Amazon Inspector. Create an Amazon EventBridge rule to monitor Amazon Inspector findings of anomalous logins. Configure the SNS topic as the target of the EventBridge rule.
A company begins to use AWS WAF after experiencing an increase in traffic to the company’s public web applications. A security engineer needs to determine if the increase in traffic is because of application-layer attacks. The security engineer needs a solution to analyze AWS WAF traffic.
Which solution will meet this requirement?
- A . Configure AWS WAF to send logs to a trail in AWS CloudTrail. Create an Amazon Data Firehose delivery stream to send the logs to Amazon OpenSearch Service. Use OpenSearch Dashboards and an Amazon Athena connector to query the logs.
- B . Configure AWS WAF to send logs to an Amazon S3 bucket. Configure an OpenSearch table with a partition projection of the S3 bucket. Use OpenSearch to query the data in the S3 bucket.
- C . Configure AWS WAF to send logs to an Amazon S3 bucket. Configure an Amazon Athena table with a partition projection of the S3 bucket. Use Athena to query the data in the S3 bucket.
- D . Configure AWS WAF to send logs to a trail in AWS CloudTrail. Create an Amazon Data Firehose delivery stream to send the logs to an Amazon S3 bucket. Use Amazon Athena to query the data in the S3 bucket.
Notify when IAM roles are modified.
- A . Use Amazon Detective.
- B . Use EventBridge with CloudTrail events.
- C . Use CloudWatch metric filters.
- D . Use CloudWatch subscription filters.
A company hosts its public website on Amazon EC2 instances behind an Application Load Balancer (ALB). The website is experiencing a global DDoS attack from a specific IoT device brand that uses a unique user agent. A security engineer is creating an AWS WAF web ACL and will associate it with the ALB.
Which rule statement will mitigate the current attack and future attacks from these IoT devices without blocking legitimate customers?
- A . Use an IP set match rule statement.
- B . Use a geographic match rule statement.
- C . Use a rate-based rule statement.
- D . Use a string match rule statement on the user agent.