Practice Free SCS-C03 Exam Online Questions
A company’s developers are using AWS Lambda function URLs to invoke functions directly. The company must ensure that developers cannot configure or deploy unauthenticated functions in production accounts. The company wants to meet this requirement by using AWS Organizations. The solution must not require additional work for the developers.
Which solution will meet these requirements?
- A . Require the developers to configure all function URLs to support cross-origin resource sharing (CORS) when the functions are called from a different domain.
- B . Use an AWS WAF delegated administrator account to view and block unauthenticated access to function URLs in production accounts, based on the OU of accounts that are using the functions.
- C . Use SCPs to allow all lambda: CreateFunctionUrlConfig and lambda: UpdateFunctionUrlConfig actions that have a lambda: FunctionUrlAuthType condition key value of AWS_IAM.
- D . Use SCPs to deny all lambda: CreateFunctionUrlConfig and lambda: UpdateFunctionUrlConfig actions that have a lambda: FunctionUrlAuthType condition key value of NONE.
A company operates a web application that runs on Amazon EC2 instances. The application listens on port 80 and port 443. The company uses an Application Load Balancer (ALB) with AWS WAF to terminate SSL and to forward traffic to the application instances only on port 80.
The ALB is in public subnets that are associated with a network ACL named NACL1. The application instances are in dedicated private subnets that are associated with a network ACL named NACL2. An Amazon RDS for PostgreSQL DB instance that uses port 5432 is in a dedicated private subnet that is associated with a network ACL named NACL3. All the network ACLs currently allow all inbound and outbound traffic.
Which set of network ACL changes will increase the security of the application while ensuring functionality?
- A . Make the following changes to NACL3:
• Add a rule that allows inbound traffic on port 5432 from NACL2.
• Add a rule that allows outbound traffic on ports 1024-65536 to NACL2.
• Remove the default rules that allow all inbound and outbound traffic. B .
Make the following changes to NACL3:
• Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the application instance subnets.
• Add a rule that allows outbound traffic on ports 1024-65536 to the application instance subnets.
• Remove the default rules that allow all inbound and outbound traffic. - B . Make the following changes to NACL2:
• Add a rule that allows outbound traffic on port 5432 to the CIDR blocks of the RDS subnets.
• Remove the default rules that allow all inbound and outbound traffic. - C . Make the following changes to NACL2:
• Add a rule that allows inbound traffic on port 5432 from the CIDR blocks of the RDS subnets.
• Add a rule that allows outbound traffic on port 5432 to the RDS subnets.
A company uses AWS Organizations. The company has teams that use an AWS CloudHSM hardware security module (HSM) that is hosted in a central AWS account. One of the teams creates its own new dedicated AWS account and wants to use the HSM that is hosted in the central account.
How should a security engineer share the HSM that is hosted in the central account with the new dedicated account?
- A . Use AWS Resource Access Manager (AWS RAM) to share the VPC subnet ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.
- B . Use AWS Identity and Access Management (IAM) to create a cross-account role to access the CloudHSM cluster that is in the central account. Create a new IAM user in the new dedicated account. Assign the cross-account role to the new IAM user.
- C . Use AWS IAM Identity Center to create an AWS Security Token Service (AWS STS) token to authenticate from the new dedicated account to the central account. Use the cross-account permissions that are assigned to the STS token to invoke an operation on the HSM in the central account.
- D . Use AWS Resource Access Manager (AWS RAM) to share the ID of the HSM that is hosted in the central account with the new dedicated account. Configure the CloudHSM security group to accept inbound traffic from the private IP addresses of client instances in the new dedicated account.
A company is migrating one of its legacy systems from an on-premises data center to AWS. The application server will run on AWS, but the database must remain in the on-premises data center for compliance reasons. The database is sensitive to network latency. Additionally, the data that travels between the on-premises data center and AWS must have IPsec encryption.
Which combination of AWS solutions will meet these requirements? (Select TWO.)
- A . AWS Site-to-Site VPN
- B . AWS Direct Connect
- C . AWS VPN CloudHub
- D . VPC peering
- E . NAT gateway
A security engineer received an Amazon GuardDuty alert indicating a finding involving the Amazon EC2 instance that hosts the company’s primary website. The GuardDuty finding received read: UnauthorizedAccess: IAMUser/InstanceCredentialExfiltration. The security engineer confirmed that a malicious actor used API access keys intended for the EC2 instance from a country where the company does not operate. The security engineer needs to deny access to the malicious actor.
What is the first step the security engineer should take?
- A . Open the EC2 console and remove any security groups that allow inbound traffic from 0.0.0.0/0.
- B . Install the AWS Systems Manager Agent on the EC2 instance and run an inventory report .
- C . Install the Amazon Inspector agent on the host and run an assessment with the CVE rules package.
- D . Open the IAM console and revoke all IAM sessions that are associated with the instance profile.
A company operates an Amazon EC2 instance that is registered as a target of a Network Load Balancer (NLB). The NLB is associated with a security group. The security group allows inbound TCP traffic on port 22 from 10.0.0.0/23.
The company maps the NLB to two subnets that share the same network ACL and route table. The route table has a route for 0.0.0.0/0 to an internet gateway. The network ACL has one inbound rule that has a priority of 20 and that allows TCP traffic on port 22 from 10.0.0.0/16.
A security engineer receives an alert that there is an unauthorized SSH session on the EC2 instance. The unauthorized session originates from 10.0.1.5. The company’s incident response procedure requires unauthorized SSH sessions to be immediately interrupted. The instance must remain running, and its memory must remain intact.
Which solution will meet these requirements?
- A . Restart the EC2 instance from either the AWS Management Console or the AWS CLI .
- B . Add a new inbound rule that has a priority of 10 to the network ACL to deny TCP traffic on port 22 from 10.0.1.5.
- C . Remove the security group rule that allows inbound TCP traffic on port 22 from 10.0.0.0/16.
- D . Update the route table to remove the route to the internet gateway.
A company runs a public web application on Amazon EKS behind Amazon CloudFront and an Application Load Balancer (ALB). A security engineer must send a notification to an existing Amazon SNS topic when the application receives 10,000 requests from the same end-user IP address within any 5-minute period.
Which solution will meet these requirements?
- A . Configure CloudFront standard logging and CloudWatch Logs metric filters.
- B . Configure VPC Flow Logs and CloudWatch Logs metric filters.
- C . Configure an AWS WAF web ACL with an ASN match rule and CloudWatch alarms.
- D . Configure an AWS WAF web ACL with a rate-based rule. Associate it with CloudFront.
Create a CloudWatch alarm to notify SNS.
A company stores sensitive data in an Amazon S3 bucket. The company encrypts the data at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). A security engineer must prevent any modifications to the data in the S3 bucket.
Which solution will meet this requirement?
- A . Configure S3 bucket policies to deny DELETE and PUT object permissions.
- B . Configure S3 Object Lock in compliance mode with S3 bucket versioning enabled.
- C . Change the encryption on the S3 bucket to use AWS Key Management Service (AWS
KMS) customer managed keys. - D . Configure the S3 bucket with multi-factor authentication (MFA) delete protection.
A company’s web application is hosted on Amazon EC2 instances running behind an Application Load Balancer (ALB) in an Auto Scaling group. An AWS WAF web ACL is associated with the ALB. AWS CloudTrail is enabled and stores logs in Amazon S3 and Amazon CloudWatch Logs.
The operations team has observed some EC2 instances reboot at random. After rebooting, all access logs on the instances have been deleted. During an investigation, the operations team found that each reboot happened just after a PHP error occurred on the new-user-creation.php file. The operations team needs to view log information to determine if the company is being attacked.
Which set of actions will identify the suspect attacker’s IP address for future occurrences?
- A . Configure VPC Flow Logs on the subnet where the ALB is located and stream the data to CloudWatch. Search for the new-user-creation.php occurrences in CloudWatch.
- B . Configure the CloudWatch agent on the ALB and send application logs to CloudWatch Logs.
- C . Configure the ALB to export access logs to an Amazon OpenSearch Service cluster and search for the new-user-creation.php occurrences.
- D . Configure the web ACL to send logs to Amazon Data Firehose, which delivers the logs to an S3 bucket. Use Amazon Athena to query the logs and find the new-user-creation.php occurrences.
A company wants to establish separate AWS Key Management Service (AWS KMS) keys to use for different AWS services .
The company’s security engineer created the following key policy to allow the infrastructure deployment team to create encrypted Amazon Elastic Block Store (Amazon EBS) volumes by assuming the InfrastructureDeployment IAM role:
{
"Version": "2012-10-17" , "Id": "key-policy-ebs" , "Statement": [
{
"Sid": "Enable IAM User Permissions" , "Effect": "Allow" , "Principal": {
"AWS": "arn: aws: iam::123456789012: root"
} , "Action": "kms:*" , "Resource": "*"
} , {
"Sid": "Allow use of the key" , "Effect": "Allow" , "Principal": {
"AWS": "arn: aws: iam::123456789012: role/aws-
reserved/sso.amazonaws.com/InfrastructureDeployment"
} , "Action": [
"kms: Encrypt" , "kms: Decrypt" , "kms: ReEncrypt*" , "kms: GenerateDataKey*" , "kms: DescribeKey" , "kms: CreateGrant" , "kms: ListGrants" , "kms: RevokeGrant"
] , "Resource": "*" , "Condition": {
"StringEquals": {
"kms: ViaService": "ec2.us-west-2.amazonaws.com"
}
}
}
]
}
The security engineer recently discovered that IAM rolesother thanthe InfrastructureDeployment role used this key for other services.
Which change to the policy should the security engineer make to resolve these issues?
- A . In the statement block that contains the Sid"Allow use of the key", under theConditionblock, change StringEquals to StringLike.
- B . In the policy document, remove the statement block that contains the Sid"Enable IAM User Permissions". Add key management policies to the KMS policy.
- C . In the statement block that contains the Sid"Allow use of the key", under theConditionblock, change the kms: ViaService value to ec2.us-east-1.amazonaws.com.
- D . In the policy document, add a new statement block that grants the kms: Disable* permission to the security engineer’s IAM role.