Practice Free SCS-C03 Exam Online Questions
A security engineer needs to implement a solution to identify any sensitive data that is stored in an Amazon S3 bucket. The solution must report on sensitive data in the S3 bucket by using an existing Amazon Simple Notification Service (Amazon SNS) topic.
Which solution will meet these requirements with the LEAST implementation effort?
- A . Enable AWS Config. Configure AWS Config to monitor for sensitive data in the S3 bucket and to send notifications to the SNS topic.
- B . Create an AWS Lambda function to scan the S3 bucket for sensitive data that matches a pattern. Program the Lambda function to send notifications to the SNS topic.
- C . Configure Amazon Macie to use managed data identifiers to identify and categorize sensitive data. Create an Amazon EventBridge rule to send notifications to the SNS topic.
- D . Enable Amazon GuardDuty. Configure AWS CloudTrail S3 data events. Create an Amazon CloudWatch alarm that reacts to GuardDuty findings and sends notifications to the SNS topic.
A company uses an organization in AWS Organizations to manage multiple AWS accounts.
The company uses AWS IAM Identity Center to manage access to the accounts. The company uses AWS Directory Service as an identity source. Employees access the AWS console and specific AWS accounts and permissions through the AWS access portal.
A security engineer creates a new permissions set in IAM Identity Center and assigns the permissions set to one of the member accounts in the organization. The security engineer assigns the permissions set to a user group for developers named DevOpsin the member account. The security engineer expects all the developers to see the new permissions set listed for the member account in the AWS access portal. All the developers except for one can see the permissions set. The security engineer must ensure that the remaining developer can see the permissions set in the AWS access portal.
Which solution will meet this requirement?
- A . Add the remaining developer to the DevOps group in Directory Service.
- B . Remove and then re-add the permissions set in the member account.
- C . Add the service-linked role for organization to the member account.
- D . Update the permissions set to allow console access for the remaining developer.
A company runs critical workloads in an on-premises data center. The company wants to implement an AWS based disaster recovery (DR) solution that will achieve an RTO of less than 1 hour. The company needs to continuously replicate physical and virtual servers. The company must optimize costs for data storage and bandwidth usage. The DR solution must be automated.
Which solution will meet these requirements?
- A . Use AWS Backup to directly replicate the on-premises servers to AWS. Enable cross-
Region backup copying and data vaulting. Configure recovery points to match the defined
RTO. Use AWS Step Functions to automate recovery steps. - B . Configure an AWS Storage Gateway Volume Gateway to use Amazon Elastic Block Store (Amazon EBS) snapshots for recovery. Configure AWS Backup to manage the snapshots. Create automated recovery procedures.
- C . Enable AWS Elastic Disaster Recovery. Configure replication agents to continuously replicate each on-premises server. Enable the default staging area subnet configuration.
- D . Create an AWS Direct Connect connection between the on-premises data center and AWS. Configure Amazon EventBridge to monitor for failures and to invoke AWS Lambda functions that launch preconfigured Amazon EC2 instances from AMIs in the event of an incident.
A security engineer needs to build a solution to turn AWS CloudTrail back on in multiple AWS Regions in case it is ever turned off.
What is the MOST efficient way to implement this solution?
- A . Use AWS Config with a managed rule to initiate the AWS-EnableCloudTrail remediation.
- B . Create an Amazon EventBridge event with a cloudtrail.amazonaws.com event source and a StartLogging event name to invoke an AWS Lambda function to call the StartLogging API .
- C . Create an Amazon CloudWatch alarm with a cloudtrail.amazonaws.com event source and a StopLogging event name to invoke an AWS Lambda function to call the StartLogging API.
- D . Monitor AWS Trusted Advisor to ensure CloudTrail logging is enabled.
A company uses an organization in AWS Organizations to manage its 250 member accounts. The company also uses AWS IAM Identity Center with a SAML external identity provider (IdP). IAM Identity Center has been delegated to a member account. The company’s security team has access to the delegated account.
The security team has been investigating a malicious internal user who might be accessing sensitive accounts. The security team needs to know when the user logged into the organization during the last 7 days.
Which solution will quickly identify the access attempts?
- A . In the delegated account, use Amazon CloudWatch Logs to search for events that match the user details for all successful attempts.
- B . In each member account, use the IAM Identity Center console to search for events that match the user details for all attempts.
- C . In the external IdP, use Amazon EventBridge to search for events that match the user details for all attempts.
- D . In the organization’s management account, use AWS CloudTrail to search for events that match the user details for all successful attempts.
A company needs centralized log monitoring with automatic detection across hundreds of AWS accounts.
Which solution meets these requirements with the LEAST operational effort?
- A . Designate a GuardDuty administrator account and enable protections.
- B . Centralize CloudWatch logs and use Inspector.
- C . Centralize CloudTrail logs and query with Athena.
- D . Stream logs to Kinesis and process with Lambda.
A company’s platform has grown rapidly over the past 6 months. The company’s platform architecture evolved quickly to accommodate the growth. The company’s development team has been deploying features quickly by using different AWS services. The development team has not performed formal architecture reviews.
The company needs to evaluate its security posture against AWS security best practices.
Which solution will meet these requirements?
- A . Create a new workload in the AWS Well-Architected Tool. Work with the development team to answer security questions based on the team’s current state. Use the save milestone feature to track improvements against identified high-risk items.
- B . Use the cost recommendations in AWS Cost Explorer. Analyze the cost implications of security misconfigurations. Prioritize architectural changes based on potential cost savings as a result of implementing AWS security best practices.
- C . Enable AWS Security Hub CSPM. Create a Security Hub CSPM automation rule to map existing services to approved architecture patterns. Use the data to identify non-compliance against AWS best practices and generate a compliance report.
- D . Enable Amazon Detective. Create a Detective investigation for AWS security best practices. Use a behavior graph to visualize the data. Analyze the entities to identify architectural components that do not follow AWS security best practices.
A company has hundreds of AWS accounts in an organization in AWS Organizations. The company operates out of a single AWS Region. The company has a dedicated security tooling AWS account in the organization. The security tooling account is configured as the organization’s delegated administrator for Amazon GuardDuty and AWS Security Hub. The company has configured the environment to automatically enable GuardDuty and Security Hub for existing AWS accounts and new AWS accounts.
The company is performing control tests on specific GuardDuty findings to make sure that the company’s security team can detect and respond to security events. The security team launched an Amazon EC2 instance and attempted to run DNS requests against a test domain, example.com, to generate a DNS finding. However, the GuardDuty finding was never created in the Security Hub delegated administrator account.
Why was the finding not created in the Security Hub delegated administrator account?
- A . VPC flow logs were not turned on for the VPC where the EC2 instance was launched.
- B . The VPC where the EC2 instance was launched had the DHCP option configured for a custom OpenDNS resolver.
- C . The GuardDuty integration with Security Hub was never activated in the AWS account where the finding was generated.
- D . Cross-Region aggregation in Security Hub was not configured.
A company has an encrypted Amazon Aurora DB cluster in the us-east-1 Region that uses an AWS KMS customer managed key. The company must copy a DB snapshot to the us-west-1 Region but cannot access the encryption key across Regions.
What should the company do to properly encrypt the snapshot in us-west-1?
- A . Store the customer managed key in AWS Secrets Manager in us-west-1.
- B . Create a new customer managed key in us-west-1 and use it to encrypt the snapshot.
- C . Create an IAM policy to allow access to the key in us-east-1 from us-west-1.
- D . Create an IAM policy that allows RDS in us-west-1 to access the key in us-east-1.
A security engineer discovers that a company’s user passwords have no required minimum length .
The company is using the following two identity providers (IdPs):
• AWS Identity and Access Management (IAM) federated with on-premises Active Directory
• Amazon Cognito user pools that contain the user database for an AWS Cloud application that the company developed
Which combination of actions should the security engineer take to implement a required minimum length for the passwords? (Select TWO.)
- A . Update the password length policy in the IAM configuration.
- B . Update the password length policy in the Cognito configuration.
- C . Update the password length policy in the on-premises Active Directory configuration.
- D . Create an SCP in AWS Organizations. Configure the SCP to enforce a minimum password length for IAM and Cognito.
- E . Create an IAM policy that includes a condition for minimum password length. Enforce the policy for IAM and Cognito.